# Flog Txt Version 1 # Analyzer Version: 2024.1.0 # Analyzer Build Date: Jan 4 2024 18:31:15 # Log Creation Date: 06.02.2024 10:16:38.985 Process: id = "1" image_name = "draft itinerary 2024 tour plan - a best outbound client.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\draft itinerary 2024 tour plan - a best outbound client.exe" page_root = "0x4fe6d000" os_pid = "0x10a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x678" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 119 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 120 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 121 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 122 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 123 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 124 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 125 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 126 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 127 start_va = 0xb70000 end_va = 0xc7ffff monitored = 1 entry_point = 0xc718ee region_type = mapped_file name = "draft itinerary 2024 tour plan - a best outbound client.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\draft itinerary 2024 tour plan - a best outbound client.exe") Region: id = 128 start_va = 0xc80000 end_va = 0xc81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 129 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 130 start_va = 0x7fca0000 end_va = 0x7fcc2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fca0000" filename = "" Region: id = 131 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 132 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 133 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 134 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 273 start_va = 0x400000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 274 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 275 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 276 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 277 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 278 start_va = 0xc90000 end_va = 0xeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 279 start_va = 0x6f890000 end_va = 0x6f8e8fff monitored = 1 entry_point = 0x6f8a0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 280 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 281 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 282 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 283 start_va = 0x7fba0000 end_va = 0x7fc9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fba0000" filename = "" Region: id = 284 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 285 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 286 start_va = 0xeb0000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 290 start_va = 0x73ea0000 end_va = 0x73f31fff monitored = 0 entry_point = 0x73ee0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 291 start_va = 0x7f7f0000 end_va = 0x7fb90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 292 start_va = 0xc80000 end_va = 0xc83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 293 start_va = 0x75a50000 end_va = 0x75acafff monitored = 0 entry_point = 0x75a6e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 294 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 295 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 296 start_va = 0x4f0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 297 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 298 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 299 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 300 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 301 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 302 start_va = 0x1000000 end_va = 0x11effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 303 start_va = 0x6f810000 end_va = 0x6f88cfff monitored = 1 entry_point = 0x6f820db0 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 304 start_va = 0x74e30000 end_va = 0x74e74fff monitored = 0 entry_point = 0x74e4de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 305 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 306 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 307 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 308 start_va = 0x5f0000 end_va = 0x777fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 309 start_va = 0xc90000 end_va = 0xcb9fff monitored = 0 entry_point = 0xc95680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 310 start_va = 0xdb0000 end_va = 0xeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000db0000" filename = "" Region: id = 311 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 312 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 313 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 314 start_va = 0x780000 end_va = 0x900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 315 start_va = 0x11f0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011f0000" filename = "" Region: id = 316 start_va = 0xc90000 end_va = 0xd9dfff monitored = 1 entry_point = 0xd918ee region_type = mapped_file name = "draft itinerary 2024 tour plan - a best outbound client.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\draft itinerary 2024 tour plan - a best outbound client.exe") Region: id = 317 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 318 start_va = 0x6fb10000 end_va = 0x6fb17fff monitored = 0 entry_point = 0x6fb117b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 319 start_va = 0x6f120000 end_va = 0x6f800fff monitored = 1 entry_point = 0x6f14cd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 320 start_va = 0x6f020000 end_va = 0x6f114fff monitored = 0 entry_point = 0x6f074160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 321 start_va = 0xc90000 end_va = 0xc90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c90000" filename = "" Region: id = 322 start_va = 0xca0000 end_va = 0xcaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ca0000" filename = "" Region: id = 323 start_va = 0xcb0000 end_va = 0xcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 324 start_va = 0xcc0000 end_va = 0xccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 325 start_va = 0xcd0000 end_va = 0xcdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 326 start_va = 0xce0000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 327 start_va = 0xcf0000 end_va = 0xcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 328 start_va = 0xd00000 end_va = 0xd00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 329 start_va = 0xd10000 end_va = 0xd10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 330 start_va = 0x1000000 end_va = 0x117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 331 start_va = 0x11e0000 end_va = 0x11effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011e0000" filename = "" Region: id = 332 start_va = 0x25f0000 end_va = 0x276ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 333 start_va = 0x910000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 334 start_va = 0x950000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 335 start_va = 0xd20000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 336 start_va = 0x2770000 end_va = 0x476ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002770000" filename = "" Region: id = 337 start_va = 0xeb0000 end_va = 0xf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 338 start_va = 0xff0000 end_va = 0xffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 339 start_va = 0xa50000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 340 start_va = 0x1000000 end_va = 0x10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 341 start_va = 0x1170000 end_va = 0x117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 342 start_va = 0x4770000 end_va = 0x4aa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 343 start_va = 0x6dd60000 end_va = 0x6f011fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll") Region: id = 344 start_va = 0x75950000 end_va = 0x75a3afff monitored = 0 entry_point = 0x7598d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 345 start_va = 0xf50000 end_va = 0xfe0fff monitored = 0 entry_point = 0xf88cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 346 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 347 start_va = 0x4ab0000 end_va = 0x4c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ab0000" filename = "" Region: id = 348 start_va = 0xd20000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 349 start_va = 0x6dce0000 end_va = 0x6dd5ffff monitored = 1 entry_point = 0x6dce1180 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 350 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 351 start_va = 0xd30000 end_va = 0xd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 352 start_va = 0xd40000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 353 start_va = 0xd50000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 354 start_va = 0xd60000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 355 start_va = 0xd70000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 356 start_va = 0xd80000 end_va = 0xd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 357 start_va = 0xd90000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 358 start_va = 0xda0000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 359 start_va = 0xf50000 end_va = 0xf5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 360 start_va = 0xf60000 end_va = 0xf6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 361 start_va = 0xf70000 end_va = 0xf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 362 start_va = 0xf80000 end_va = 0xf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f80000" filename = "" Region: id = 363 start_va = 0x6d310000 end_va = 0x6dcdbfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\1be7a15b1f33bf22e4f53aaf45518c77\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\1be7a15b1f33bf22e4f53aaf45518c77\\system.ni.dll") Region: id = 364 start_va = 0xf90000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 365 start_va = 0xfa0000 end_va = 0xfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 366 start_va = 0xfb0000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 367 start_va = 0xfc0000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 368 start_va = 0xfd0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 369 start_va = 0xfe0000 end_va = 0xfeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 370 start_va = 0x1100000 end_va = 0x110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 371 start_va = 0x1110000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 372 start_va = 0x1120000 end_va = 0x112ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 373 start_va = 0x1130000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 374 start_va = 0x1140000 end_va = 0x114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 375 start_va = 0x1150000 end_va = 0x115ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 376 start_va = 0xd40000 end_va = 0xd4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 377 start_va = 0xd50000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 378 start_va = 0xd60000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 379 start_va = 0xd70000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 380 start_va = 0xd80000 end_va = 0xd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 381 start_va = 0xd90000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 382 start_va = 0xda0000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 383 start_va = 0xf50000 end_va = 0xf5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 384 start_va = 0xf60000 end_va = 0xf6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 385 start_va = 0xf70000 end_va = 0xf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 386 start_va = 0xf80000 end_va = 0xf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f80000" filename = "" Region: id = 387 start_va = 0xf90000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 388 start_va = 0xfa0000 end_va = 0xfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 389 start_va = 0xfb0000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 390 start_va = 0xfc0000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 391 start_va = 0xfd0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 392 start_va = 0x6cbe0000 end_va = 0x6d300fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\eb4cca4f06a15158c3f7e2c56516729b\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\eb4cca4f06a15158c3f7e2c56516729b\\system.core.ni.dll") Region: id = 393 start_va = 0x71590000 end_va = 0x715aafff monitored = 0 entry_point = 0x71599050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 394 start_va = 0xd50000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 395 start_va = 0xd60000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 396 start_va = 0xd70000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 397 start_va = 0xd80000 end_va = 0xd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 398 start_va = 0xd90000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 399 start_va = 0xda0000 end_va = 0xdaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 400 start_va = 0xf50000 end_va = 0xf5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 401 start_va = 0xf60000 end_va = 0xf6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 402 start_va = 0xf70000 end_va = 0xf7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 403 start_va = 0xf80000 end_va = 0xf8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f80000" filename = "" Region: id = 404 start_va = 0xf90000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 405 start_va = 0xfa0000 end_va = 0xfaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 406 start_va = 0xfb0000 end_va = 0xfbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fb0000" filename = "" Region: id = 407 start_va = 0xfc0000 end_va = 0xfcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fc0000" filename = "" Region: id = 408 start_va = 0xfd0000 end_va = 0xfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 409 start_va = 0xfe0000 end_va = 0xfeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 410 start_va = 0x1100000 end_va = 0x110ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 411 start_va = 0x1110000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 412 start_va = 0x1120000 end_va = 0x112ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 413 start_va = 0x1130000 end_va = 0x113ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001130000" filename = "" Region: id = 414 start_va = 0x1140000 end_va = 0x114ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001140000" filename = "" Region: id = 415 start_va = 0x25f0000 end_va = 0x26d5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 416 start_va = 0x2760000 end_va = 0x276ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 417 start_va = 0x25f0000 end_va = 0x2742fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 418 start_va = 0x25f0000 end_va = 0x273dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 419 start_va = 0xd50000 end_va = 0xd54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d50000" filename = "" Region: id = 420 start_va = 0xd60000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 421 start_va = 0xd70000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 422 start_va = 0x71250000 end_va = 0x71262fff monitored = 0 entry_point = 0x71259950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 423 start_va = 0x70280000 end_va = 0x702aefff monitored = 0 entry_point = 0x702995e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 424 start_va = 0xd60000 end_va = 0xd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 425 start_va = 0xd70000 end_va = 0xd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 426 start_va = 0xd80000 end_va = 0xd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 450 start_va = 0xa90000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 451 start_va = 0x25f0000 end_va = 0x26effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 478 start_va = 0xad0000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 479 start_va = 0xb10000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 480 start_va = 0x4ab0000 end_va = 0x4baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ab0000" filename = "" Region: id = 481 start_va = 0x4c60000 end_va = 0x4c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c60000" filename = "" Region: id = 482 start_va = 0x4c70000 end_va = 0x4d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c70000" filename = "" Region: id = 483 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 484 start_va = 0x4d70000 end_va = 0x4e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d70000" filename = "" Thread: id = 1 os_tid = 0xd74 [0141.134] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0141.278] RoInitialize () returned 0x1 [0141.279] RoUninitialize () returned 0x0 [0142.328] GetCurrentProcessId () returned 0x10a4 [0142.337] OpenProcess (dwDesiredAccess=0x38, bInheritHandle=1, dwProcessId=0x10a4) returned 0x264 [0142.351] VirtualProtect (in: lpAddress=0xb721a4, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.353] VirtualProtect (in: lpAddress=0xb721a4, dwSize=0x14, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.354] VirtualProtect (in: lpAddress=0xb72260, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.354] VirtualProtect (in: lpAddress=0xb72260, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.354] VirtualProtect (in: lpAddress=0xb823c4, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.354] VirtualProtect (in: lpAddress=0xb823c4, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.355] VirtualProtect (in: lpAddress=0xc6ee8c, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.355] VirtualProtect (in: lpAddress=0xc6ee8c, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.355] VirtualProtect (in: lpAddress=0xc6ef04, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.355] VirtualProtect (in: lpAddress=0xc6ef04, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.355] VirtualProtect (in: lpAddress=0xc6ef14, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.356] VirtualProtect (in: lpAddress=0xc6ef14, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.356] VirtualProtect (in: lpAddress=0xc6ef24, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.356] VirtualProtect (in: lpAddress=0xc6ef24, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.356] VirtualProtect (in: lpAddress=0xc6ef34, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.356] VirtualProtect (in: lpAddress=0xc6ef34, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.356] VirtualProtect (in: lpAddress=0xc6ef44, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.357] VirtualProtect (in: lpAddress=0xc6ef44, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.357] VirtualProtect (in: lpAddress=0xc6ef54, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.357] VirtualProtect (in: lpAddress=0xc6ef54, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.357] VirtualProtect (in: lpAddress=0xc6ef64, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.357] VirtualProtect (in: lpAddress=0xc6ef64, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.358] VirtualProtect (in: lpAddress=0xc6ef74, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.358] VirtualProtect (in: lpAddress=0xc6ef74, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.358] VirtualProtect (in: lpAddress=0xc6ef84, dwSize=0x14, flNewProtect=0x4, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x2) returned 1 [0142.358] VirtualProtect (in: lpAddress=0xc6ef84, dwSize=0x14, flNewProtect=0x2, lpflOldProtect=0x18e55c | out: lpflOldProtect=0x18e55c*=0x4) returned 1 [0142.365] CloseHandle (hObject=0x264) returned 1 [0143.055] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x18e518 | out: pfEnabled=0x18e518) returned 0x0 [0143.096] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x18d2b8 | out: phkResult=0x18d2b8*=0x0) returned 0x2 [0143.101] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe", nBufferLength=0x105, lpBuffer=0x18e330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe", lpFilePart=0x0) returned 0x59 [0143.103] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe", nBufferLength=0x105, lpBuffer=0x18e3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe", lpFilePart=0x0) returned 0x59 [0143.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18e850) returned 1 [0143.105] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\draft itinerary 2024 tour plan - a best outbound client.exe"), fInfoLevelId=0x0, lpFileInformation=0x18e8cc | out: lpFileInformation=0x18e8cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ef49680, ftCreationTime.dwHighDateTime=0x1da58e5, ftLastAccessTime.dwLowDateTime=0x8ef49680, ftLastAccessTime.dwHighDateTime=0x1da58e5, ftLastWriteTime.dwLowDateTime=0x735d7600, ftLastWriteTime.dwHighDateTime=0x1da56c2, nFileSizeHigh=0x0, nFileSizeLow=0x10d648)) returned 1 [0143.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e84c) returned 1 [0143.105] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe", nBufferLength=0x105, lpBuffer=0x18e330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe", lpFilePart=0x0) returned 0x59 [0143.115] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe", nBufferLength=0x105, lpBuffer=0x18e334, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe", lpFilePart=0x0) returned 0x59 [0143.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18e86c) returned 1 [0143.115] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Draft Itinerary 2024 tour plan - A Best Outbound client.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\draft itinerary 2024 tour plan - a best outbound client.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x290 [0143.116] GetFileType (hFile=0x290) returned 0x1 [0143.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e868) returned 1 [0143.116] GetFileType (hFile=0x290) returned 0x1 [0143.116] GetFileSize (in: hFile=0x290, lpFileSizeHigh=0x18e950 | out: lpFileSizeHigh=0x18e950*=0x0) returned 0x10d648 [0143.119] ReadFile (in: hFile=0x290, lpBuffer=0x37754f0, nNumberOfBytesToRead=0x10d648, lpNumberOfBytesRead=0x18e8fc, lpOverlapped=0x0 | out: lpBuffer=0x37754f0*, lpNumberOfBytesRead=0x18e8fc*=0x10d648, lpOverlapped=0x0) returned 1 [0143.146] CloseHandle (hObject=0x290) returned 1 [0143.242] GetCurrentProcessId () returned 0x10a4 [0143.242] OpenProcess (dwDesiredAccess=0x10, bInheritHandle=1, dwProcessId=0x10a4) returned 0x290 [0143.252] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xb823dc, lpBuffer=0x277bb0c, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277bb0c*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.257] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xb823e0, lpBuffer=0x3882b58, nSize=0xdd440, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x3882b58*, lpNumberOfBytesRead=0xcd4440*=0xdd440) returned 1 [0143.419] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f820, lpBuffer=0x277c190, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277c190*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.419] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f824, lpBuffer=0x277c1a0, nSize=0x10, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277c1a0*, lpNumberOfBytesRead=0xcd4440*=0x10) returned 1 [0143.420] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f834, lpBuffer=0x277c918, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277c918*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.420] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f838, lpBuffer=0x277c928, nSize=0x10, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277c928*, lpNumberOfBytesRead=0xcd4440*=0x10) returned 1 [0143.465] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f848, lpBuffer=0x277d09c, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277d09c*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.465] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f84c, lpBuffer=0x277d0ac, nSize=0x10, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277d0ac*, lpNumberOfBytesRead=0xcd4440*=0x10) returned 1 [0143.465] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f85c, lpBuffer=0x277d82c, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277d82c*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.466] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f860, lpBuffer=0x277d83c, nSize=0x10, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277d83c*, lpNumberOfBytesRead=0xcd4440*=0x10) returned 1 [0143.481] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f870, lpBuffer=0x277dfb0, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277dfb0*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.481] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f874, lpBuffer=0x277dfc0, nSize=0x10, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277dfc0*, lpNumberOfBytesRead=0xcd4440*=0x10) returned 1 [0143.482] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f884, lpBuffer=0x277e734, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277e734*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.482] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f888, lpBuffer=0x277e744, nSize=0x10, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277e744*, lpNumberOfBytesRead=0xcd4440*=0x10) returned 1 [0143.498] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f898, lpBuffer=0x277eeb8, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277eeb8*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.498] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f89c, lpBuffer=0x277eec8, nSize=0x10, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277eec8*, lpNumberOfBytesRead=0xcd4440*=0x10) returned 1 [0143.499] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f8ac, lpBuffer=0x277f63c, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277f63c*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.499] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f8b0, lpBuffer=0x277f64c, nSize=0x10, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277f64c*, lpNumberOfBytesRead=0xcd4440*=0x10) returned 1 [0143.518] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f8c0, lpBuffer=0x277fdc0, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277fdc0*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.518] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f8c4, lpBuffer=0x277fdd0, nSize=0x10, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x277fdd0*, lpNumberOfBytesRead=0xcd4440*=0x10) returned 1 [0143.519] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f8d4, lpBuffer=0x2780554, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x2780554*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.519] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f8d8, lpBuffer=0x2780564, nSize=0x10, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x2780564*, lpNumberOfBytesRead=0xcd4440*=0x10) returned 1 [0143.539] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f8e8, lpBuffer=0x2780cd8, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x2780cd8*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.539] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f8ec, lpBuffer=0x2780ce8, nSize=0x20, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x2780ce8*, lpNumberOfBytesRead=0xcd4440*=0x20) returned 1 [0143.539] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f90c, lpBuffer=0x27814a8, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x27814a8*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.539] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f910, lpBuffer=0x27814b8, nSize=0x10, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x27814b8*, lpNumberOfBytesRead=0xcd4440*=0x10) returned 1 [0143.540] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f920, lpBuffer=0x2781c3c, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x2781c3c*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.540] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f924, lpBuffer=0x2781c4c, nSize=0x80, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x2781c4c*, lpNumberOfBytesRead=0xcd4440*=0x80) returned 1 [0143.542] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f9a4, lpBuffer=0x2782580, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x2782580*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.542] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f9a8, lpBuffer=0x2782590, nSize=0x20, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x2782590*, lpNumberOfBytesRead=0xcd4440*=0x20) returned 1 [0143.543] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f9c8, lpBuffer=0x2782d50, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x2782d50*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.543] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f9cc, lpBuffer=0x2782d60, nSize=0x30, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x2782d60*, lpNumberOfBytesRead=0xcd4440*=0x30) returned 1 [0143.549] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5f9fc, lpBuffer=0x27835f0, nSize=0x4, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x27835f0*, lpNumberOfBytesRead=0xcd4440*=0x4) returned 1 [0143.550] ReadProcessMemory (in: hProcess=0x290, lpBaseAddress=0xc5fa00, lpBuffer=0x2783600, nSize=0xf480, lpNumberOfBytesRead=0xcd4440 | out: lpBuffer=0x2783600*, lpNumberOfBytesRead=0xcd4440*=0xf480) returned 1 [0143.586] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4400, lpName=0x0) returned 0x28c [0143.586] memcpy (in: _Dst=0xd50000, _Src=0x280ae78, _Size=0x4400 | out: _Dst=0xd50000) returned 0xd50000 [0143.587] CloseHandle (hObject=0x28c) returned 1 [0144.020] CreateProcessW (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe", lpCommandLine="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18e3a0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18e7e4 | out: lpCommandLine="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\"", lpProcessInformation=0x18e7e4*(hProcess=0x2a0, hThread=0x294, dwProcessId=0x12ec, dwThreadId=0x12e4)) returned 1 [0144.084] GetThreadContext (in: hThread=0x294, lpContext=0x2829f84 | out: lpContext=0x2829f84*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x386000, Edx=0x0, Ecx=0x0, Eax=0xdcab66, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0144.110] ReadProcessMemory (in: hProcess=0x2a0, lpBaseAddress=0x386008, lpBuffer=0x18e7d4, nSize=0x4, lpNumberOfBytesRead=0x18e838 | out: lpBuffer=0x18e7d4*, lpNumberOfBytesRead=0x18e838*=0x4) returned 1 [0144.134] VirtualAllocEx (hProcess=0x2a0, lpAddress=0x400000, dwSize=0x42000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0144.149] WriteProcessMemory (in: hProcess=0x2a0, lpBaseAddress=0x400000, lpBuffer=0x40e3bf8*, nSize=0x200, lpNumberOfBytesWritten=0x18e838 | out: lpBuffer=0x40e3bf8*, lpNumberOfBytesWritten=0x18e838*=0x200) returned 1 [0144.184] WriteProcessMemory (in: hProcess=0x2a0, lpBaseAddress=0x402000, lpBuffer=0x413e518*, nSize=0x3b600, lpNumberOfBytesWritten=0x18e838 | out: lpBuffer=0x413e518*, lpNumberOfBytesWritten=0x18e838*=0x3b600) returned 1 [0144.225] WriteProcessMemory (in: hProcess=0x2a0, lpBaseAddress=0x43e000, lpBuffer=0x282a25c*, nSize=0x600, lpNumberOfBytesWritten=0x18e838 | out: lpBuffer=0x282a25c*, lpNumberOfBytesWritten=0x18e838*=0x600) returned 1 [0144.233] WriteProcessMemory (in: hProcess=0x2a0, lpBaseAddress=0x440000, lpBuffer=0x282a868*, nSize=0x200, lpNumberOfBytesWritten=0x18e838 | out: lpBuffer=0x282a868*, lpNumberOfBytesWritten=0x18e838*=0x200) returned 1 [0144.251] WriteProcessMemory (in: hProcess=0x2a0, lpBaseAddress=0x386008, lpBuffer=0x282aa74*, nSize=0x4, lpNumberOfBytesWritten=0x18e838 | out: lpBuffer=0x282aa74*, lpNumberOfBytesWritten=0x18e838*=0x4) returned 1 [0144.258] SetThreadContext (hThread=0x294, lpContext=0x2829f84*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x386000, Edx=0x0, Ecx=0x0, Eax=0x43d51e, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0144.274] ResumeThread (hThread=0x294) returned 0x1 [0144.344] CoGetContextToken (in: pToken=0x18f788 | out: pToken=0x18f788) returned 0x0 [0144.344] CObjectContext::QueryInterface () returned 0x0 [0144.344] CObjectContext::GetCurrentThreadType () returned 0x0 [0144.344] Release () returned 0x0 [0144.346] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0xdcc1b0*=0x14c, lpdwindex=0x18f62c | out: lpdwindex=0x18f62c) returned 0x0 Thread: id = 2 os_tid = 0x12a4 Thread: id = 3 os_tid = 0x1290 Thread: id = 4 os_tid = 0x12c4 [0141.281] CoGetContextToken (in: pToken=0x10ffa64 | out: pToken=0x10ffa64) returned 0x800401f0 [0141.281] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0141.281] RoInitialize () returned 0x1 [0141.281] RoUninitialize () returned 0x0 [0144.399] RegCloseKey (hKey=0x80000004) returned 0x0 Thread: id = 6 os_tid = 0x12dc Thread: id = 8 os_tid = 0x1210 Thread: id = 9 os_tid = 0x11bc Thread: id = 10 os_tid = 0x1354 Process: id = "2" image_name = "aspnet_compiler.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_compiler.exe" page_root = "0x5e15f000" os_pid = "0x12ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x10a4" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 427 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 428 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 429 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 430 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 431 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 432 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 433 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 434 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 435 start_va = 0xdc0000 end_va = 0xdcffff monitored = 0 entry_point = 0xdcab66 region_type = mapped_file name = "aspnet_compiler.exe" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_compiler.exe") Region: id = 436 start_va = 0xdd0000 end_va = 0xdd1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 437 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 438 start_va = 0x7e970000 end_va = 0x7e992fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e970000" filename = "" Region: id = 439 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 440 start_va = 0x7fff0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 441 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 442 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 443 start_va = 0x400000 end_va = 0x441fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 444 start_va = 0x450000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 445 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 446 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 447 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 448 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 449 start_va = 0xde0000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 452 start_va = 0x6f890000 end_va = 0x6f8e8fff monitored = 1 entry_point = 0x6f8a0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 453 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 454 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 455 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 456 start_va = 0x7e870000 end_va = 0x7e96ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e870000" filename = "" Region: id = 457 start_va = 0x450000 end_va = 0x50dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 458 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 459 start_va = 0xdd0000 end_va = 0xe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 460 start_va = 0xe30000 end_va = 0xe3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 461 start_va = 0xf70000 end_va = 0x106ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f70000" filename = "" Region: id = 462 start_va = 0xdd0000 end_va = 0xdd3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 463 start_va = 0x75a50000 end_va = 0x75acafff monitored = 0 entry_point = 0x75a6e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 464 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 465 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 466 start_va = 0x540000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 467 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 468 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 469 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 470 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 471 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 472 start_va = 0xe40000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 473 start_va = 0x6f810000 end_va = 0x6f88cfff monitored = 1 entry_point = 0x6f820db0 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 474 start_va = 0x74e30000 end_va = 0x74e74fff monitored = 0 entry_point = 0x74e4de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 475 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 476 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 477 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 485 start_va = 0x640000 end_va = 0x7c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 486 start_va = 0xde0000 end_va = 0xe09fff monitored = 0 entry_point = 0xde5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 487 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 488 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 489 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 490 start_va = 0x7d0000 end_va = 0x950fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 491 start_va = 0x1070000 end_va = 0x246ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001070000" filename = "" Region: id = 492 start_va = 0xde0000 end_va = 0xdedfff monitored = 0 entry_point = 0xdeab66 region_type = mapped_file name = "aspnet_compiler.exe" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_compiler.exe") Region: id = 493 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 494 start_va = 0x6fb10000 end_va = 0x6fb17fff monitored = 0 entry_point = 0x6fb117b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 495 start_va = 0x2470000 end_va = 0x2b50fff monitored = 1 entry_point = 0x249cd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 496 start_va = 0x6f120000 end_va = 0x6f800fff monitored = 1 entry_point = 0x6f14cd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 497 start_va = 0x6f020000 end_va = 0x6f114fff monitored = 0 entry_point = 0x6f074160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 498 start_va = 0xde0000 end_va = 0xde0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 499 start_va = 0xdf0000 end_va = 0xdfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000df0000" filename = "" Region: id = 500 start_va = 0xe00000 end_va = 0xe0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 501 start_va = 0xe10000 end_va = 0xe1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 502 start_va = 0xe20000 end_va = 0xe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 503 start_va = 0xe40000 end_va = 0xe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 504 start_va = 0xef0000 end_va = 0xefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 505 start_va = 0xe50000 end_va = 0xe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 506 start_va = 0xe60000 end_va = 0xe60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 507 start_va = 0xe70000 end_va = 0xe70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 508 start_va = 0x2470000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 509 start_va = 0x2500000 end_va = 0x26affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 510 start_va = 0x960000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 511 start_va = 0x9a0000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 512 start_va = 0xe80000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 513 start_va = 0x26b0000 end_va = 0x46affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026b0000" filename = "" Region: id = 514 start_va = 0x2500000 end_va = 0x259ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 515 start_va = 0x26a0000 end_va = 0x26affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 516 start_va = 0xaa0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 517 start_va = 0xae0000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 518 start_va = 0x46b0000 end_va = 0x49e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 519 start_va = 0x6dd60000 end_va = 0x6f011fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll") Region: id = 520 start_va = 0x75950000 end_va = 0x75a3afff monitored = 0 entry_point = 0x7598d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 521 start_va = 0x25a0000 end_va = 0x2630fff monitored = 0 entry_point = 0x25d8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 522 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 523 start_va = 0x25a0000 end_va = 0x263ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 524 start_va = 0xe80000 end_va = 0xe8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 525 start_va = 0xe90000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 526 start_va = 0x6dce0000 end_va = 0x6dd5ffff monitored = 1 entry_point = 0x6dce1180 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 527 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 528 start_va = 0xea0000 end_va = 0xeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 529 start_va = 0x6d310000 end_va = 0x6dcdbfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\1be7a15b1f33bf22e4f53aaf45518c77\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\1be7a15b1f33bf22e4f53aaf45518c77\\system.ni.dll") Region: id = 530 start_va = 0x6d180000 end_va = 0x6d30efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\system.drawing.ni.dll") Region: id = 531 start_va = 0x6c510000 end_va = 0x6d176fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\system.windows.forms.ni.dll") Region: id = 532 start_va = 0xeb0000 end_va = 0xeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 533 start_va = 0x6bde0000 end_va = 0x6c500fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\eb4cca4f06a15158c3f7e2c56516729b\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\eb4cca4f06a15158c3f7e2c56516729b\\system.core.ni.dll") Region: id = 534 start_va = 0x6bce0000 end_va = 0x6bdd0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\fe4b221b4109f0c78f57a792500699b5\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\fe4b221b4109f0c78f57a792500699b5\\system.configuration.ni.dll") Region: id = 535 start_va = 0x6b5c0000 end_va = 0x6bcddfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\4fbda26d781323081b45526da6e87b35\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\4fbda26d781323081b45526da6e87b35\\system.xml.ni.dll") Region: id = 536 start_va = 0x75a40000 end_va = 0x75a45fff monitored = 0 entry_point = 0x75a41460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 537 start_va = 0xeb0000 end_va = 0xebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 538 start_va = 0xee0000 end_va = 0xeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 539 start_va = 0xbe0000 end_va = 0xcdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 540 start_va = 0x75ca0000 end_va = 0x7709efff monitored = 0 entry_point = 0x75e5b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 541 start_va = 0x758c0000 end_va = 0x758f6fff monitored = 0 entry_point = 0x758c3b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 542 start_va = 0x74f10000 end_va = 0x75408fff monitored = 0 entry_point = 0x75117610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 543 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 544 start_va = 0x74d60000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d67410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 545 start_va = 0x74f00000 end_va = 0x74f0efff monitored = 0 entry_point = 0x74f02e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 546 start_va = 0xeb0000 end_va = 0xeb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000eb0000" filename = "" Region: id = 547 start_va = 0x71590000 end_va = 0x715aafff monitored = 0 entry_point = 0x71599050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 548 start_va = 0x71250000 end_va = 0x71262fff monitored = 0 entry_point = 0x71259950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 549 start_va = 0x70280000 end_va = 0x702aefff monitored = 0 entry_point = 0x702995e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 550 start_va = 0x6b4a0000 end_va = 0x6b5bcfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\98d3949f9ba1a384939805aa5e47e933\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\98d3949f9ba1a384939805aa5e47e933\\system.management.ni.dll") Region: id = 551 start_va = 0xce0000 end_va = 0xd1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 552 start_va = 0x49f0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 553 start_va = 0x7e820000 end_va = 0x7e86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007e820000" filename = "" Region: id = 554 start_va = 0x7e810000 end_va = 0x7e81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007e810000" filename = "" Region: id = 555 start_va = 0xec0000 end_va = 0xec0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ec0000" filename = "" Region: id = 556 start_va = 0x75700000 end_va = 0x75783fff monitored = 0 entry_point = 0x75726220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 557 start_va = 0xed0000 end_va = 0xed0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ed0000" filename = "" Region: id = 558 start_va = 0x6b480000 end_va = 0x6b49bfff monitored = 0 entry_point = 0x6b48aa90 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 559 start_va = 0x6b410000 end_va = 0x6b476fff monitored = 0 entry_point = 0x6b42b610 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 560 start_va = 0xd20000 end_va = 0xd5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 561 start_va = 0x4af0000 end_va = 0x4beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 562 start_va = 0x74db0000 end_va = 0x74e0efff monitored = 0 entry_point = 0x74db4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 563 start_va = 0xd60000 end_va = 0xd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 564 start_va = 0xf00000 end_va = 0xf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 565 start_va = 0x4bf0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bf0000" filename = "" Region: id = 566 start_va = 0x4cf0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 567 start_va = 0x2470000 end_va = 0x24affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 568 start_va = 0x24f0000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 569 start_va = 0x4df0000 end_va = 0x4eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 570 start_va = 0x6b400000 end_va = 0x6b40cfff monitored = 0 entry_point = 0x6b403520 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 571 start_va = 0x6b3f0000 end_va = 0x6b3fafff monitored = 1 entry_point = 0x6b3f41f0 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 572 start_va = 0xf40000 end_va = 0xf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 573 start_va = 0xf40000 end_va = 0xf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 574 start_va = 0xf40000 end_va = 0xf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 962 start_va = 0x6b3d0000 end_va = 0x6b3e0fff monitored = 0 entry_point = 0x6b3d8fa0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 963 start_va = 0x6b310000 end_va = 0x6b3cefff monitored = 0 entry_point = 0x6b341e80 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1034 start_va = 0x2470000 end_va = 0x24affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 1035 start_va = 0x4df0000 end_va = 0x4eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 1038 start_va = 0x520000 end_va = 0x522fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 1126 start_va = 0x24b0000 end_va = 0x24effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 1127 start_va = 0x4ef0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ef0000" filename = "" Region: id = 1271 start_va = 0x520000 end_va = 0x524fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 1897 start_va = 0x520000 end_va = 0x522fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 1898 start_va = 0x24b0000 end_va = 0x24effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 1899 start_va = 0x4ef0000 end_va = 0x4feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ef0000" filename = "" Region: id = 1901 start_va = 0xda0000 end_va = 0xdb2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000da0000" filename = "" Region: id = 1914 start_va = 0xf40000 end_va = 0xf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f40000" filename = "" Region: id = 1915 start_va = 0xf40000 end_va = 0xf50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f40000" filename = "" Region: id = 1916 start_va = 0x6b260000 end_va = 0x6b304fff monitored = 0 entry_point = 0x6b27ac50 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 1917 start_va = 0x6b230000 end_va = 0x6b252fff monitored = 0 entry_point = 0x6b235570 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 1918 start_va = 0x6b220000 end_va = 0x6b22ffff monitored = 0 entry_point = 0x6b223820 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 1919 start_va = 0xf60000 end_va = 0xf63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f60000" filename = "" Region: id = 1920 start_va = 0x71450000 end_va = 0x7149efff monitored = 0 entry_point = 0x7145d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 1921 start_va = 0x4ef0000 end_va = 0x4fcffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1922 start_va = 0x24b0000 end_va = 0x24effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 1923 start_va = 0x4fd0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fd0000" filename = "" Region: id = 1924 start_va = 0x714a0000 end_va = 0x7153afff monitored = 0 entry_point = 0x714df7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 1925 start_va = 0x71570000 end_va = 0x71581fff monitored = 0 entry_point = 0x71574510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 1926 start_va = 0x71540000 end_va = 0x7156efff monitored = 0 entry_point = 0x7154bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 1927 start_va = 0x747b0000 end_va = 0x747b6fff monitored = 0 entry_point = 0x747b1e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1928 start_va = 0x6b200000 end_va = 0x6b212fff monitored = 0 entry_point = 0x6b2025d0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 1929 start_va = 0x6b1e0000 end_va = 0x6b1f3fff monitored = 0 entry_point = 0x6b1e3c10 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 1930 start_va = 0x25a0000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 1931 start_va = 0x2630000 end_va = 0x263ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 1932 start_va = 0x50d0000 end_va = 0x51cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1933 start_va = 0x25e0000 end_va = 0x25e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1934 start_va = 0x25e0000 end_va = 0x25e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1935 start_va = 0x25e0000 end_va = 0x25e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1936 start_va = 0x25e0000 end_va = 0x25e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1937 start_va = 0x25e0000 end_va = 0x25e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1938 start_va = 0x25e0000 end_va = 0x25e8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1939 start_va = 0x70aa0000 end_va = 0x70b23fff monitored = 0 entry_point = 0x70ac6530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 1940 start_va = 0x71440000 end_va = 0x71447fff monitored = 0 entry_point = 0x71441fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 1941 start_va = 0x6fc50000 end_va = 0x6fc57fff monitored = 0 entry_point = 0x6fc51920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 1942 start_va = 0x6fc60000 end_va = 0x6fca6fff monitored = 0 entry_point = 0x6fc758d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 1943 start_va = 0x25e0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 1944 start_va = 0x25e0000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 1945 start_va = 0x51d0000 end_va = 0x52cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 1946 start_va = 0x520000 end_va = 0x522fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 1947 start_va = 0x25e0000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 1948 start_va = 0x51d0000 end_va = 0x52cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051d0000" filename = "" Region: id = 1949 start_va = 0x25e0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 1950 start_va = 0x25e0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 1951 start_va = 0x25e0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 1952 start_va = 0x25e0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 1953 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1954 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1955 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 1956 start_va = 0x2620000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 1957 start_va = 0x2640000 end_va = 0x264ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 1958 start_va = 0x25e0000 end_va = 0x25effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 1959 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1960 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1961 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1962 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1963 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 1964 start_va = 0x2620000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 1965 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1966 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1967 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 1968 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1969 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1970 start_va = 0x6ff20000 end_va = 0x6ff59fff monitored = 0 entry_point = 0x6ff39be0 region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\SysWOW64\\vaultcli.dll" (normalized: "c:\\windows\\syswow64\\vaultcli.dll") Region: id = 1971 start_va = 0x6fe50000 end_va = 0x6ff17fff monitored = 0 entry_point = 0x6febae90 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 1972 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1973 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1974 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1975 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1976 start_va = 0x6b110000 end_va = 0x6b1d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Security\\754ca70e68140abcdb8476cff64c4169\\System.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.security\\754ca70e68140abcdb8476cff64c4169\\system.security.ni.dll") Region: id = 1977 start_va = 0x740d0000 end_va = 0x74247fff monitored = 0 entry_point = 0x74128a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1978 start_va = 0x75810000 end_va = 0x7581dfff monitored = 0 entry_point = 0x75815410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1979 start_va = 0x6fb50000 end_va = 0x6fb57fff monitored = 0 entry_point = 0x6fb51d70 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll") Region: id = 1980 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1981 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1982 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1983 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1984 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 1985 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1986 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1987 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1988 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1989 start_va = 0x5270000 end_va = 0x530bfff monitored = 1 entry_point = 0x52fe9a6 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 1990 start_va = 0x25f0000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1991 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1992 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1993 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1994 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1995 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1996 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1997 start_va = 0x2640000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 1998 start_va = 0x5310000 end_va = 0x540ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005310000" filename = "" Region: id = 2000 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2001 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2002 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2003 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2004 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2005 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2006 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2007 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2008 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2009 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2011 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2012 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 2013 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 2014 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 2015 start_va = 0x2640000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 2016 start_va = 0x5310000 end_va = 0x540ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005310000" filename = "" Region: id = 2018 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2019 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2020 start_va = 0x2640000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 2021 start_va = 0x5310000 end_va = 0x540ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005310000" filename = "" Region: id = 2022 start_va = 0x2640000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 2023 start_va = 0x5310000 end_va = 0x540ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005310000" filename = "" Region: id = 2027 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2028 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2029 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2030 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2031 start_va = 0x2610000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 2032 start_va = 0x6fe40000 end_va = 0x6fe49fff monitored = 0 entry_point = 0x6fe43200 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2033 start_va = 0x6fbe0000 end_va = 0x6fc43fff monitored = 0 entry_point = 0x6fbfafd0 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 2034 start_va = 0x6fbd0000 end_va = 0x6fbdffff monitored = 0 entry_point = 0x6fbd4600 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll") Region: id = 2035 start_va = 0x6fbb0000 end_va = 0x6fbcffff monitored = 0 entry_point = 0x6fbbd120 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 2036 start_va = 0x6fb80000 end_va = 0x6fbabfff monitored = 0 entry_point = 0x6fb9bb10 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll") Region: id = 2037 start_va = 0x6fb60000 end_va = 0x6fb79fff monitored = 0 entry_point = 0x6fb6fa70 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll") Region: id = 2038 start_va = 0x2640000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002640000" filename = "" Region: id = 2039 start_va = 0x5310000 end_va = 0x540ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005310000" filename = "" Region: id = 2040 start_va = 0x51d0000 end_va = 0x5231fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 2041 start_va = 0x5410000 end_va = 0x548ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005410000" filename = "" Region: id = 2042 start_va = 0x6b020000 end_va = 0x6b107fff monitored = 1 entry_point = 0x6b057980 region_type = mapped_file name = "diasymreader.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\diasymreader.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\diasymreader.dll") Region: id = 2043 start_va = 0x5490000 end_va = 0x558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 2044 start_va = 0x2600000 end_va = 0x2600fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2045 start_va = 0x2610000 end_va = 0x2610fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002610000" filename = "" Region: id = 2046 start_va = 0x2610000 end_va = 0x262dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002610000" filename = "" Region: id = 2047 start_va = 0x2610000 end_va = 0x2610fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 2048 start_va = 0x2620000 end_va = 0x262afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002620000" filename = "" Region: id = 2049 start_va = 0x2610000 end_va = 0x2610fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 2050 start_va = 0x2620000 end_va = 0x2623fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002620000" filename = "" Region: id = 2051 start_va = 0x2610000 end_va = 0x2610fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002610000" filename = "" Region: id = 2052 start_va = 0x2620000 end_va = 0x2620fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Thread: id = 5 os_tid = 0x12e4 [0145.247] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0145.263] RoInitialize () returned 0x1 [0145.263] RoUninitialize () returned 0x0 [0146.445] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x230 [0146.446] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x234 [0146.501] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e06c | out: phkResult=0x18e06c*=0x244) returned 0x0 [0146.502] RegQueryValueExW (in: hKey=0x244, lpValueName="InstallationType", lpReserved=0x0, lpType=0x18e08c, lpData=0x0, lpcbData=0x18e088*=0x0 | out: lpType=0x18e08c*=0x1, lpData=0x0, lpcbData=0x18e088*=0xe) returned 0x0 [0146.503] RegQueryValueExW (in: hKey=0x244, lpValueName="InstallationType", lpReserved=0x0, lpType=0x18e08c, lpData=0x26b469c, lpcbData=0x18e088*=0xe | out: lpType=0x18e08c*=0x1, lpData="Client", lpcbData=0x18e088*=0xe) returned 0x0 [0146.505] RegCloseKey (hKey=0x244) returned 0x0 [0146.819] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe.config", nBufferLength=0x105, lpBuffer=0x18da08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe.config", lpFilePart=0x0) returned 0x48 [0146.823] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x18c928 | out: phkResult=0x18c928*=0x0) returned 0x2 [0147.206] GetCurrentProcess () returned 0xffffffff [0147.207] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18dd68 | out: TokenHandle=0x18dd68*=0x244) returned 1 [0147.212] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x18d800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0147.217] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x18dd60 | out: lpFileInformation=0x18dd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0147.218] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x18d7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0147.221] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x18dd68 | out: lpFileInformation=0x18dd68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0147.222] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x18d768, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0147.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18dca0) returned 1 [0147.224] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x248 [0147.224] GetFileType (hFile=0x248) returned 0x1 [0147.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18dc9c) returned 1 [0147.224] GetFileType (hFile=0x248) returned 0x1 [0147.260] GetFileSize (in: hFile=0x248, lpFileSizeHigh=0x18dd5c | out: lpFileSizeHigh=0x18dd5c*=0x0) returned 0x8c8f [0147.260] ReadFile (in: hFile=0x248, lpBuffer=0x26b8a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18dd18, lpOverlapped=0x0 | out: lpBuffer=0x26b8a04*, lpNumberOfBytesRead=0x18dd18*=0x1000, lpOverlapped=0x0) returned 1 [0147.282] ReadFile (in: hFile=0x248, lpBuffer=0x26b8a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18dbc8, lpOverlapped=0x0 | out: lpBuffer=0x26b8a04*, lpNumberOfBytesRead=0x18dbc8*=0x1000, lpOverlapped=0x0) returned 1 [0147.283] ReadFile (in: hFile=0x248, lpBuffer=0x26b8a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18da7c, lpOverlapped=0x0 | out: lpBuffer=0x26b8a04*, lpNumberOfBytesRead=0x18da7c*=0x1000, lpOverlapped=0x0) returned 1 [0147.285] ReadFile (in: hFile=0x248, lpBuffer=0x26b8a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18da7c, lpOverlapped=0x0 | out: lpBuffer=0x26b8a04*, lpNumberOfBytesRead=0x18da7c*=0x1000, lpOverlapped=0x0) returned 1 [0147.285] ReadFile (in: hFile=0x248, lpBuffer=0x26b8a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18da7c, lpOverlapped=0x0 | out: lpBuffer=0x26b8a04*, lpNumberOfBytesRead=0x18da7c*=0x1000, lpOverlapped=0x0) returned 1 [0147.285] ReadFile (in: hFile=0x248, lpBuffer=0x26b8a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18d9b4, lpOverlapped=0x0 | out: lpBuffer=0x26b8a04*, lpNumberOfBytesRead=0x18d9b4*=0x1000, lpOverlapped=0x0) returned 1 [0147.290] ReadFile (in: hFile=0x248, lpBuffer=0x26b8a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18db34, lpOverlapped=0x0 | out: lpBuffer=0x26b8a04*, lpNumberOfBytesRead=0x18db34*=0x1000, lpOverlapped=0x0) returned 1 [0147.292] ReadFile (in: hFile=0x248, lpBuffer=0x26b8a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x26b8a04*, lpNumberOfBytesRead=0x18da44*=0x1000, lpOverlapped=0x0) returned 1 [0147.292] ReadFile (in: hFile=0x248, lpBuffer=0x26b8a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18da44, lpOverlapped=0x0 | out: lpBuffer=0x26b8a04*, lpNumberOfBytesRead=0x18da44*=0xc8f, lpOverlapped=0x0) returned 1 [0147.293] ReadFile (in: hFile=0x248, lpBuffer=0x26b8a04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18db04, lpOverlapped=0x0 | out: lpBuffer=0x26b8a04*, lpNumberOfBytesRead=0x18db04*=0x0, lpOverlapped=0x0) returned 1 [0147.293] CloseHandle (hObject=0x248) returned 1 [0147.295] GetCurrentProcess () returned 0xffffffff [0147.295] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18deac | out: TokenHandle=0x18deac*=0x248) returned 1 [0147.295] GetCurrentProcess () returned 0xffffffff [0147.295] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18deac | out: TokenHandle=0x18deac*=0x24c) returned 1 [0147.296] GetCurrentProcess () returned 0xffffffff [0147.296] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18dd68 | out: TokenHandle=0x18dd68*=0x250) returned 1 [0147.296] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_compiler.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x18dd60 | out: lpFileInformation=0x18dd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0147.296] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe.config", nBufferLength=0x105, lpBuffer=0x18d7cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe.config", lpFilePart=0x0) returned 0x48 [0147.296] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_compiler.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x18dd68 | out: lpFileInformation=0x18dd68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0147.297] GetCurrentProcess () returned 0xffffffff [0147.297] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18deac | out: TokenHandle=0x18deac*=0x254) returned 1 [0147.297] GetCurrentProcess () returned 0xffffffff [0147.297] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18deac | out: TokenHandle=0x18deac*=0x258) returned 1 [0147.314] GetCurrentProcess () returned 0xffffffff [0147.314] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18dd0c | out: TokenHandle=0x18dd0c*=0x25c) returned 1 [0147.339] GetCurrentProcess () returned 0xffffffff [0147.339] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18dd1c | out: TokenHandle=0x18dd1c*=0x260) returned 1 [0147.378] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ee54 | out: phkResult=0x18ee54*=0x264) returned 0x0 [0147.378] RegQueryValueExW (in: hKey=0x264, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x18ee70, lpData=0x0, lpcbData=0x18ee6c*=0x0 | out: lpType=0x18ee70*=0x4, lpData=0x0, lpcbData=0x18ee6c*=0x4) returned 0x0 [0147.379] RegQueryValueExW (in: hKey=0x264, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x18ee70, lpData=0x18ee5c, lpcbData=0x18ee6c*=0x4 | out: lpType=0x18ee70*=0x4, lpData=0x18ee5c*=0x1, lpcbData=0x18ee6c*=0x4) returned 0x0 [0147.380] RegQueryValueExW (in: hKey=0x264, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x18eea8, lpData=0x0, lpcbData=0x18eea4*=0x0 | out: lpType=0x18eea8*=0x4, lpData=0x0, lpcbData=0x18eea4*=0x4) returned 0x0 [0147.382] RegCloseKey (hKey=0x264) returned 0x0 [0147.387] GetCurrentProcessId () returned 0x12ec [0147.392] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x18e6ec | out: lpLuid=0x18e6ec*(LowPart=0x14, HighPart=0)) returned 1 [0147.396] GetCurrentProcess () returned 0xffffffff [0147.396] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x18e6e8 | out: TokenHandle=0x18e6e8*=0x26c) returned 1 [0147.396] AdjustTokenPrivileges (in: TokenHandle=0x26c, DisableAllPrivileges=0, NewState=0x26d5b60*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0147.397] CloseHandle (hObject=0x26c) returned 1 [0147.400] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12ec) returned 0x26c [0147.501] EnumProcessModules (in: hProcess=0x26c, lphModule=0x26d5ba4, cb=0x100, lpcbNeeded=0x18ee5c | out: lphModule=0x26d5ba4, lpcbNeeded=0x18ee5c) returned 1 [0147.502] GetModuleInformation (in: hProcess=0x26c, hModule=0x400000, lpmodinfo=0x26d5ce4, cb=0xc | out: lpmodinfo=0x26d5ce4*(lpBaseOfDll=0x400000, SizeOfImage=0x42000, EntryPoint=0x0)) returned 1 [0147.504] CoTaskMemAlloc (cb=0x804) returned 0xfd4a20 [0147.504] GetModuleBaseNameW (in: hProcess=0x26c, hModule=0x400000, lpBaseName=0xfd4a20, nSize=0x800 | out: lpBaseName="aspnet_compiler.exe") returned 0x13 [0147.505] CoTaskMemFree (pv=0xfd4a20) [0147.506] CoTaskMemAlloc (cb=0x804) returned 0xfd4a20 [0147.506] GetModuleFileNameExW (in: hProcess=0x26c, hModule=0x400000, lpFilename=0xfd4a20, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_compiler.exe")) returned 0x41 [0147.506] CoTaskMemFree (pv=0xfd4a20) [0147.506] CloseHandle (hObject=0x26c) returned 1 [0147.507] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe", nBufferLength=0x105, lpBuffer=0x18e964, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe", lpFilePart=0x0) returned 0x41 [0147.507] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SecurityProtocol", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ee54 | out: phkResult=0x18ee54*=0x0) returned 0x2 [0147.560] EtwEventRegister (in: ProviderId=0x26da118, EnableCallback=0xee0656, CallbackContext=0x0, RegHandle=0x26da0f4 | out: RegHandle=0x26da0f4) returned 0x0 [0147.564] EtwEventSetInformation (RegHandle=0xf82a58, InformationClass=0x1c, EventInformation=0x2, InformationLength=0x26da0a8) returned 0x0 [0147.590] GetCurrentProcessId () returned 0x12ec [0147.590] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x12ec) returned 0x270 [0147.590] EnumProcessModules (in: hProcess=0x270, lphModule=0x26dbafc, cb=0x100, lpcbNeeded=0x18ee64 | out: lphModule=0x26dbafc, lpcbNeeded=0x18ee64) returned 1 [0147.591] GetModuleInformation (in: hProcess=0x270, hModule=0x400000, lpmodinfo=0x26dbc3c, cb=0xc | out: lpmodinfo=0x26dbc3c*(lpBaseOfDll=0x400000, SizeOfImage=0x42000, EntryPoint=0x0)) returned 1 [0147.591] CoTaskMemAlloc (cb=0x804) returned 0xfd4a20 [0147.591] GetModuleBaseNameW (in: hProcess=0x270, hModule=0x400000, lpBaseName=0xfd4a20, nSize=0x800 | out: lpBaseName="aspnet_compiler.exe") returned 0x13 [0147.591] CoTaskMemFree (pv=0xfd4a20) [0147.591] CoTaskMemAlloc (cb=0x804) returned 0xfd4a20 [0147.591] GetModuleFileNameExW (in: hProcess=0x270, hModule=0x400000, lpFilename=0xfd4a20, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_compiler.exe")) returned 0x41 [0147.592] CoTaskMemFree (pv=0xfd4a20) [0147.592] CloseHandle (hObject=0x270) returned 1 [0147.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe", nBufferLength=0x105, lpBuffer=0x18e96c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe", lpFilePart=0x0) returned 0x41 [0147.592] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ee5c | out: phkResult=0x18ee5c*=0x0) returned 0x2 [0147.592] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ee5c | out: phkResult=0x18ee5c*=0x270) returned 0x0 [0147.592] RegQueryValueExW (in: hKey=0x270, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x18ee78, lpData=0x0, lpcbData=0x18ee74*=0x0 | out: lpType=0x18ee78*=0x0, lpData=0x0, lpcbData=0x18ee74*=0x0) returned 0x2 [0147.592] RegCloseKey (hKey=0x270) returned 0x0 [0147.657] GetCurrentProcessId () returned 0x12ec [0147.668] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x36b94d0, Length=0x20000, ResultLength=0x18eeb8 | out: SystemInformation=0x36b94d0, ResultLength=0x18eeb8*=0x15308) returned 0x0 [0147.754] GetCurrentProcessId () returned 0x12ec [0147.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x36b94d0, Length=0x20000, ResultLength=0x18eea8 | out: SystemInformation=0x36b94d0, ResultLength=0x18eea8*=0x15308) returned 0x0 [0149.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x18e838, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0149.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x18e89c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0149.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed44) returned 1 [0149.090] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x18edc0 | out: lpFileInformation=0x18edc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0149.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed40) returned 1 [0149.166] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x18ec9c | out: pfEnabled=0x18ec9c) returned 0x0 [0149.384] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2fc [0149.386] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x30c [0149.404] SetEvent (hEvent=0x30c) returned 1 [0149.437] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ee24*=0x2fc, lpdwindex=0x18ec44 | out: lpdwindex=0x18ec44) returned 0x0 [0149.555] CoGetContextToken (in: pToken=0x18ecf0 | out: pToken=0x18ecf0) returned 0x0 [0149.555] CoGetContextToken (in: pToken=0x18ec50 | out: pToken=0x18ec50) returned 0x0 [0149.555] WbemDefPath:IUnknown:QueryInterface (in: This=0xfbae38, riid=0x18ed20*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ed1c | out: ppvObject=0x18ed1c*=0xfbae38) returned 0x0 [0149.556] WbemDefPath:IUnknown:AddRef (This=0xfbae38) returned 0x3 [0149.556] WbemDefPath:IUnknown:Release (This=0xfbae38) returned 0x2 [0149.560] WbemDefPath:IWbemPath:SetText (This=0xfbae38, uMode=0x4, pszPath="Win32_BaseBoard") returned 0x0 [0149.563] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfbae38, puCount=0x18eea4 | out: puCount=0x18eea4*=0x0) returned 0x0 [0149.563] WbemDefPath:IWbemPath:GetText (in: This=0xfbae38, lFlags=2, puBuffLength=0x18eea0*=0x0, pszText=0x0 | out: puBuffLength=0x18eea0*=0x10, pszText=0x0) returned 0x0 [0149.564] WbemDefPath:IWbemPath:GetText (in: This=0xfbae38, lFlags=2, puBuffLength=0x18eea0*=0x10, pszText="000000000000000" | out: puBuffLength=0x18eea0*=0x10, pszText="Win32_BaseBoard") returned 0x0 [0149.564] WbemDefPath:IWbemPath:GetInfo (in: This=0xfbae38, uRequestedInfo=0x0, puResponse=0x18eeac | out: puResponse=0x18eeac*=0xc15) returned 0x0 [0149.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfbae38, puCount=0x18eea4 | out: puCount=0x18eea4*=0x0) returned 0x0 [0149.565] WbemDefPath:IWbemPath:GetInfo (in: This=0xfbae38, uRequestedInfo=0x0, puResponse=0x18eeac | out: puResponse=0x18eeac*=0xc15) returned 0x0 [0149.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfbae38, puCount=0x18ee94 | out: puCount=0x18ee94*=0x0) returned 0x0 [0149.565] WbemDefPath:IWbemPath:GetText (in: This=0xfbae38, lFlags=2, puBuffLength=0x18ee90*=0x0, pszText=0x0 | out: puBuffLength=0x18ee90*=0x10, pszText=0x0) returned 0x0 [0149.565] WbemDefPath:IWbemPath:GetText (in: This=0xfbae38, lFlags=2, puBuffLength=0x18ee90*=0x10, pszText="000000000000000" | out: puBuffLength=0x18ee90*=0x10, pszText="Win32_BaseBoard") returned 0x0 [0149.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfbae38, puCount=0x18ee94 | out: puCount=0x18ee94*=0x0) returned 0x0 [0149.565] WbemDefPath:IWbemPath:GetText (in: This=0xfbae38, lFlags=2, puBuffLength=0x18ee90*=0x0, pszText=0x0 | out: puBuffLength=0x18ee90*=0x10, pszText=0x0) returned 0x0 [0149.565] WbemDefPath:IWbemPath:GetText (in: This=0xfbae38, lFlags=2, puBuffLength=0x18ee90*=0x10, pszText="000000000000000" | out: puBuffLength=0x18ee90*=0x10, pszText="Win32_BaseBoard") returned 0x0 [0149.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfbae38, puCount=0x18ee24 | out: puCount=0x18ee24*=0x0) returned 0x0 [0149.566] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x388 [0149.566] SetEvent (hEvent=0x30c) returned 1 [0149.566] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18e67c*=0x388, lpdwindex=0x18e49c | out: lpdwindex=0x18e49c) returned 0x0 [0149.569] CoGetContextToken (in: pToken=0x18e548 | out: pToken=0x18e548) returned 0x0 [0149.569] CoGetContextToken (in: pToken=0x18e4a8 | out: pToken=0x18e4a8) returned 0x0 [0149.569] WbemDefPath:IUnknown:QueryInterface (in: This=0xfc1f50, riid=0x18e578*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e574 | out: ppvObject=0x18e574*=0xfc1f50) returned 0x0 [0149.569] WbemDefPath:IUnknown:AddRef (This=0xfc1f50) returned 0x3 [0149.569] WbemDefPath:IUnknown:Release (This=0xfc1f50) returned 0x2 [0149.569] WbemDefPath:IWbemPath:SetText (This=0xfc1f50, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0149.570] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee10 | out: puCount=0x18ee10*=0x2) returned 0x0 [0149.570] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee0c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee0c*=0xf, pszText=0x0) returned 0x0 [0149.570] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.570] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x38c [0149.570] SetEvent (hEvent=0x30c) returned 1 [0149.570] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed6c*=0x38c, lpdwindex=0x18eb8c | out: lpdwindex=0x18eb8c) returned 0x0 [0149.572] CoGetContextToken (in: pToken=0x18ec38 | out: pToken=0x18ec38) returned 0x0 [0149.572] CoGetContextToken (in: pToken=0x18eb98 | out: pToken=0x18eb98) returned 0x0 [0149.572] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdbb90, riid=0x18ec68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xfdbb90) returned 0x0 [0149.572] WbemDefPath:IUnknown:AddRef (This=0xfdbb90) returned 0x3 [0149.572] WbemDefPath:IUnknown:Release (This=0xfdbb90) returned 0x2 [0149.572] WbemDefPath:IWbemPath:SetText (This=0xfdbb90, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0149.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfdbb90, puCount=0x18ede8 | out: puCount=0x18ede8*=0x2) returned 0x0 [0149.572] WbemDefPath:IWbemPath:GetText (in: This=0xfdbb90, lFlags=4, puBuffLength=0x18ede4*=0x0, pszText=0x0 | out: puBuffLength=0x18ede4*=0xf, pszText=0x0) returned 0x0 [0149.572] WbemDefPath:IWbemPath:GetText (in: This=0xfdbb90, lFlags=4, puBuffLength=0x18ede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.602] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed08*=0x3a0, lpdwindex=0x18ebbc | out: lpdwindex=0x18ebbc) returned 0x0 [0152.763] CoGetContextToken (in: pToken=0x18eb00 | out: pToken=0x18eb00) returned 0x0 [0152.763] CoGetContextToken (in: pToken=0x18eaa8 | out: pToken=0x18eaa8) returned 0x0 [0152.763] IUnknown:QueryInterface (in: This=0xfb21f0, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea84 | out: ppvObject=0x18ea84*=0xfb2200) returned 0x0 [0152.764] CObjectContext::ContextCallback () returned 0x0 [0152.826] IUnknown:Release (This=0xfb2200) returned 0x1 [0152.827] CoUnmarshalInterface (in: pStm=0xff27a0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eaf4 | out: ppv=0x18eaf4*=0xff8160) returned 0x0 [0152.827] CoMarshalInterface (pStm=0xff27a0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff8160, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0152.828] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e994 | out: ppvObject=0x18e994*=0xff8160) returned 0x0 [0152.828] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e950 | out: ppvObject=0x18e950*=0x0) returned 0x80004002 [0152.829] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e76c | out: ppvObject=0x18e76c*=0x0) returned 0x80004002 [0152.829] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e544 | out: ppvObject=0x18e544*=0x0) returned 0x80004002 [0152.830] WbemLocator:IUnknown:AddRef (This=0xff8160) returned 0x3 [0152.830] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e2a4 | out: ppvObject=0x18e2a4*=0x0) returned 0x80004002 [0152.830] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e254 | out: ppvObject=0x18e254*=0x0) returned 0x80004002 [0152.830] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e260 | out: ppvObject=0x18e260*=0xff80bc) returned 0x0 [0152.830] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff80bc, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e268 | out: pCid=0x18e268*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.830] WbemLocator:IUnknown:Release (This=0xff80bc) returned 0x3 [0152.830] CoGetContextToken (in: pToken=0x18e2c0 | out: pToken=0x18e2c0) returned 0x0 [0152.830] IUnknown:QueryInterface (in: This=0xfb2138, riid=0x6f2238a4*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e27c | out: ppvObject=0x18e27c*=0xfb2144) returned 0x0 [0152.830] IComThreadingInfo:GetCurrentApartmentType (in: This=0xfb2144, pAptType=0x18e2ac | out: pAptType=0x18e2ac*=3) returned 0x0 [0152.830] IUnknown:Release (This=0xfb2144) returned 0x0 [0152.830] CoGetObjectContext (in: riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xfef2ec | out: ppv=0xfef2ec*=0xfb2138) returned 0x0 [0152.831] CoGetContextToken (in: pToken=0x18e6c8 | out: pToken=0x18e6c8) returned 0x0 [0152.831] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e754 | out: ppvObject=0x18e754*=0xff8144) returned 0x0 [0152.831] WbemLocator:IRpcOptions:Query (in: This=0xff8144, pPrx=0xff8160, dwProperty=2, pdwValue=0x18e760 | out: pdwValue=0x18e760) returned 0x0 [0152.831] WbemLocator:IUnknown:Release (This=0xff8144) returned 0x3 [0152.831] WbemLocator:IUnknown:Release (This=0xff8160) returned 0x2 [0152.831] WbemLocator:IUnknown:Release (This=0xff8160) returned 0x1 [0152.831] CoGetContextToken (in: pToken=0x18ea40 | out: pToken=0x18ea40) returned 0x0 [0152.831] WbemLocator:IUnknown:AddRef (This=0xff8160) returned 0x2 [0152.832] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecf8 | out: ppvObject=0x18ecf8*=0xff813c) returned 0x0 [0152.832] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff813c, pProxy=0xff8160, pAuthnSvc=0x18ed48, pAuthzSvc=0x18ed44, pServerPrincName=0x18ed3c, pAuthnLevel=0x18ed40, pImpLevel=0x18ed30, pAuthInfo=0x18ed34, pCapabilites=0x18ed38 | out: pAuthnSvc=0x18ed48*=0xa, pAuthzSvc=0x18ed44*=0x0, pServerPrincName=0x18ed3c, pAuthnLevel=0x18ed40*=0x6, pImpLevel=0x18ed30*=0x2, pAuthInfo=0x18ed34, pCapabilites=0x18ed38*=0x1) returned 0x0 [0152.832] WbemLocator:IUnknown:Release (This=0xff813c) returned 0x2 [0152.832] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecec | out: ppvObject=0x18ecec*=0xff8160) returned 0x0 [0152.832] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecd8 | out: ppvObject=0x18ecd8*=0xff813c) returned 0x0 [0152.832] WbemLocator:IClientSecurity:SetBlanket (This=0xff813c, pProxy=0xff8160, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0152.833] WbemLocator:IUnknown:Release (This=0xff813c) returned 0x3 [0152.833] WbemLocator:IUnknown:Release (This=0xff8160) returned 0x2 [0152.833] CoTaskMemFree (pv=0xff3048) [0152.833] WbemLocator:IUnknown:Release (This=0xff8160) returned 0x1 [0152.833] SysStringLen (param_1=0x0) returned 0x0 [0152.833] CoGetContextToken (in: pToken=0x18ecb8 | out: pToken=0x18ecb8) returned 0x0 [0152.833] CoGetContextToken (in: pToken=0x18ec18 | out: pToken=0x18ec18) returned 0x0 [0152.833] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x18ece8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18ece4 | out: ppvObject=0x18ece4*=0xfbbe70) returned 0x0 [0152.834] WbemLocator:IUnknown:AddRef (This=0xfbbe70) returned 0x3 [0152.834] WbemLocator:IUnknown:Release (This=0xfbbe70) returned 0x2 [0152.834] CoGetContextToken (in: pToken=0x18ec78 | out: pToken=0x18ec78) returned 0x0 [0152.834] WbemLocator:IUnknown:AddRef (This=0xfbbe70) returned 0x3 [0152.834] WbemLocator:IUnknown:QueryInterface (in: This=0xfbbe70, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecf8 | out: ppvObject=0x18ecf8*=0xff813c) returned 0x0 [0152.834] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff813c, pProxy=0xfbbe70, pAuthnSvc=0x18ed48, pAuthzSvc=0x18ed44, pServerPrincName=0x18ed3c, pAuthnLevel=0x18ed40, pImpLevel=0x18ed30, pAuthInfo=0x18ed34, pCapabilites=0x18ed38 | out: pAuthnSvc=0x18ed48*=0xa, pAuthzSvc=0x18ed44*=0x0, pServerPrincName=0x18ed3c, pAuthnLevel=0x18ed40*=0x6, pImpLevel=0x18ed30*=0x2, pAuthInfo=0x18ed34, pCapabilites=0x18ed38*=0x1) returned 0x0 [0152.834] WbemLocator:IUnknown:Release (This=0xff813c) returned 0x3 [0152.834] WbemLocator:IUnknown:QueryInterface (in: This=0xfbbe70, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecec | out: ppvObject=0x18ecec*=0xff8160) returned 0x0 [0152.834] WbemLocator:IUnknown:QueryInterface (in: This=0xfbbe70, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecd8 | out: ppvObject=0x18ecd8*=0xff813c) returned 0x0 [0152.834] WbemLocator:IClientSecurity:SetBlanket (This=0xff813c, pProxy=0xfbbe70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0152.835] WbemLocator:IUnknown:Release (This=0xff813c) returned 0x4 [0152.835] WbemLocator:IUnknown:Release (This=0xff8160) returned 0x3 [0152.835] CoTaskMemFree (pv=0xff31c8) [0152.835] WbemLocator:IUnknown:Release (This=0xfbbe70) returned 0x2 [0152.835] SysStringLen (param_1=0x0) returned 0x0 [0152.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfdbb90, puCount=0x18ee0c | out: puCount=0x18ee0c*=0x2) returned 0x0 [0152.836] WbemDefPath:IWbemPath:GetText (in: This=0xfdbb90, lFlags=4, puBuffLength=0x18ee08*=0x0, pszText=0x0 | out: puBuffLength=0x18ee08*=0xf, pszText=0x0) returned 0x0 [0152.836] WbemDefPath:IWbemPath:GetText (in: This=0xfdbb90, lFlags=4, puBuffLength=0x18ee08*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee08*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0152.836] CoGetContextToken (in: pToken=0x18ea78 | out: pToken=0x18ea78) returned 0x0 [0152.836] CoUnmarshalInterface (in: pStm=0xff27a0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ea6c | out: ppv=0x18ea6c*=0xff8160) returned 0x0 [0152.837] CoMarshalInterface (pStm=0xff27a0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff8160, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0152.837] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e90c | out: ppvObject=0x18e90c*=0xff8160) returned 0x0 [0152.837] WbemLocator:IUnknown:Release (This=0xff8160) returned 0x3 [0152.837] WbemLocator:IUnknown:Release (This=0xff8160) returned 0x2 [0152.837] CoGetContextToken (in: pToken=0x18e9b8 | out: pToken=0x18e9b8) returned 0x0 [0152.837] WbemLocator:IUnknown:AddRef (This=0xff8160) returned 0x3 [0152.837] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec70 | out: ppvObject=0x18ec70*=0xff813c) returned 0x0 [0152.837] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff813c, pProxy=0xff8160, pAuthnSvc=0x18ecc0, pAuthzSvc=0x18ecbc, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8, pImpLevel=0x18eca8, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0 | out: pAuthnSvc=0x18ecc0*=0xa, pAuthzSvc=0x18ecbc*=0x0, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8*=0x6, pImpLevel=0x18eca8*=0x3, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0*=0x20) returned 0x0 [0152.837] WbemLocator:IUnknown:Release (This=0xff813c) returned 0x3 [0152.837] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xff8160) returned 0x0 [0152.838] WbemLocator:IUnknown:QueryInterface (in: This=0xff8160, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec50 | out: ppvObject=0x18ec50*=0xff813c) returned 0x0 [0152.838] WbemLocator:IClientSecurity:SetBlanket (This=0xff813c, pProxy=0xff8160, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0152.838] WbemLocator:IUnknown:Release (This=0xff813c) returned 0x4 [0152.838] WbemLocator:IUnknown:Release (This=0xff8160) returned 0x3 [0152.838] WbemLocator:IUnknown:Release (This=0xff8160) returned 0x2 [0152.838] SysStringLen (param_1=0x0) returned 0x0 [0152.838] CoGetContextToken (in: pToken=0x18ec30 | out: pToken=0x18ec30) returned 0x0 [0152.838] WbemLocator:IUnknown:AddRef (This=0xfbbe70) returned 0x3 [0152.838] WbemLocator:IUnknown:Release (This=0xfbbe70) returned 0x2 [0152.838] CoGetContextToken (in: pToken=0x18ebf0 | out: pToken=0x18ebf0) returned 0x0 [0152.838] WbemLocator:IUnknown:AddRef (This=0xfbbe70) returned 0x3 [0152.838] WbemLocator:IUnknown:QueryInterface (in: This=0xfbbe70, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec70 | out: ppvObject=0x18ec70*=0xff813c) returned 0x0 [0152.838] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff813c, pProxy=0xfbbe70, pAuthnSvc=0x18ecc0, pAuthzSvc=0x18ecbc, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8, pImpLevel=0x18eca8, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0 | out: pAuthnSvc=0x18ecc0*=0xa, pAuthzSvc=0x18ecbc*=0x0, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8*=0x6, pImpLevel=0x18eca8*=0x3, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0*=0x20) returned 0x0 [0152.839] WbemLocator:IUnknown:Release (This=0xff813c) returned 0x3 [0152.839] WbemLocator:IUnknown:QueryInterface (in: This=0xfbbe70, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xff8160) returned 0x0 [0152.839] WbemLocator:IUnknown:QueryInterface (in: This=0xfbbe70, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec50 | out: ppvObject=0x18ec50*=0xff813c) returned 0x0 [0152.839] WbemLocator:IClientSecurity:SetBlanket (This=0xff813c, pProxy=0xfbbe70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0152.839] WbemLocator:IUnknown:Release (This=0xff813c) returned 0x4 [0152.839] WbemLocator:IUnknown:Release (This=0xff8160) returned 0x3 [0152.839] WbemLocator:IUnknown:Release (This=0xfbbe70) returned 0x2 [0152.839] SysStringLen (param_1=0x0) returned 0x0 [0152.839] WbemDefPath:IWbemPath:GetText (in: This=0xfbae38, lFlags=2, puBuffLength=0x18ee10*=0x0, pszText=0x0 | out: puBuffLength=0x18ee10*=0x10, pszText=0x0) returned 0x0 [0152.839] WbemDefPath:IWbemPath:GetText (in: This=0xfbae38, lFlags=2, puBuffLength=0x18ee10*=0x10, pszText="000000000000000" | out: puBuffLength=0x18ee10*=0x10, pszText="Win32_BaseBoard") returned 0x0 [0152.851] IWbemServices:GetObject (in: This=0xfbbe70, strObjectPath="Win32_BaseBoard", lFlags=0, pCtx=0x0, ppObject=0x18edc4*=0x0, ppCallResult=0x0 | out: ppObject=0x18edc4*=0xffd3f0, ppCallResult=0x0) returned 0x0 [0153.013] IWbemClassObject:Get (in: This=0xffd3f0, wszName="__PATH", lFlags=0, pVal=0x18edac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee54*=0, plFlavor=0x18ee50*=0 | out: pVal=0x18edac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_BaseBoard", varVal2=0x0), pType=0x18ee54*=8, plFlavor=0x18ee50*=64) returned 0x0 [0153.017] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_BaseBoard") returned 0x46 [0153.017] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_BaseBoard") returned 0x46 [0153.018] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x404 [0153.018] SetEvent (hEvent=0x30c) returned 1 [0153.018] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed68*=0x404, lpdwindex=0x18eb84 | out: lpdwindex=0x18eb84) returned 0x0 [0153.023] CoGetContextToken (in: pToken=0x18ec38 | out: pToken=0x18ec38) returned 0x0 [0153.023] CoGetContextToken (in: pToken=0x18eb98 | out: pToken=0x18eb98) returned 0x0 [0153.023] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd610, riid=0x18ec68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xffd610) returned 0x0 [0153.023] WbemDefPath:IUnknown:AddRef (This=0xffd610) returned 0x3 [0153.023] WbemDefPath:IUnknown:Release (This=0xffd610) returned 0x2 [0153.023] WbemDefPath:IWbemPath:SetText (This=0xffd610, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_BaseBoard") returned 0x0 [0153.023] IWbemClassObject:Get (in: This=0xffd3f0, wszName="__CLASS", lFlags=0, pVal=0x18ee1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee9c*=0, plFlavor=0x18ee98*=0 | out: pVal=0x18ee1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_BaseBoard", varVal2=0x0), pType=0x18ee9c*=8, plFlavor=0x18ee98*=64) returned 0x0 [0153.023] SysStringByteLen (bstr="Win32_BaseBoard") returned 0x1e [0153.023] SysStringByteLen (bstr="Win32_BaseBoard") returned 0x1e [0153.023] CoGetContextToken (in: pToken=0x18ec38 | out: pToken=0x18ec38) returned 0x0 [0153.023] WbemLocator:IUnknown:AddRef (This=0xfbbe70) returned 0x3 [0153.023] IWbemServices:CreateInstanceEnum (in: This=0xfbbe70, strFilter="Win32_BaseBoard", lFlags=17, pCtx=0x0, ppEnum=0x18ee18 | out: ppEnum=0x18ee18*=0xfdc7d8) returned 0x0 [0153.028] IUnknown:QueryInterface (in: This=0xfdc7d8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18eca4 | out: ppvObject=0x18eca4*=0xfdc7dc) returned 0x0 [0153.028] IClientSecurity:QueryBlanket (in: This=0xfdc7dc, pProxy=0xfdc7d8, pAuthnSvc=0x18ecf4, pAuthzSvc=0x18ecf0, pServerPrincName=0x18ece8, pAuthnLevel=0x18ecec, pImpLevel=0x18ecdc, pAuthInfo=0x18ece0, pCapabilites=0x18ece4 | out: pAuthnSvc=0x18ecf4*=0xa, pAuthzSvc=0x18ecf0*=0x0, pServerPrincName=0x18ece8, pAuthnLevel=0x18ecec*=0x6, pImpLevel=0x18ecdc*=0x2, pAuthInfo=0x18ece0, pCapabilites=0x18ece4*=0x1) returned 0x0 [0153.028] IUnknown:Release (This=0xfdc7dc) returned 0x1 [0153.028] IUnknown:QueryInterface (in: This=0xfdc7d8, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec98 | out: ppvObject=0x18ec98*=0xffa0c0) returned 0x0 [0153.028] IUnknown:QueryInterface (in: This=0xfdc7d8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec84 | out: ppvObject=0x18ec84*=0xfdc7dc) returned 0x0 [0153.028] IClientSecurity:SetBlanket (This=0xfdc7dc, pProxy=0xfdc7d8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0153.148] IUnknown:Release (This=0xfdc7dc) returned 0x2 [0153.148] WbemLocator:IUnknown:Release (This=0xffa0c0) returned 0x1 [0153.148] CoTaskMemFree (pv=0xff3018) [0153.148] IUnknown:QueryInterface (in: This=0xfdc7d8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e88c | out: ppvObject=0x18e88c*=0xffa0c0) returned 0x0 [0153.148] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e848 | out: ppvObject=0x18e848*=0x0) returned 0x80004002 [0153.151] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e664 | out: ppvObject=0x18e664*=0x0) returned 0x80004002 [0153.154] IUnknown:QueryInterface (in: This=0xfdc7d8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e43c | out: ppvObject=0x18e43c*=0x0) returned 0x80004002 [0153.155] WbemLocator:IUnknown:AddRef (This=0xffa0c0) returned 0x3 [0153.155] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e19c | out: ppvObject=0x18e19c*=0x0) returned 0x80004002 [0153.155] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e14c | out: ppvObject=0x18e14c*=0x0) returned 0x80004002 [0153.155] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e158 | out: ppvObject=0x18e158*=0xffa01c) returned 0x0 [0153.155] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xffa01c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e160 | out: pCid=0x18e160*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.155] WbemLocator:IUnknown:Release (This=0xffa01c) returned 0x3 [0153.155] CoGetContextToken (in: pToken=0x18e1b8 | out: pToken=0x18e1b8) returned 0x0 [0153.155] CoGetContextToken (in: pToken=0x18e5c0 | out: pToken=0x18e5c0) returned 0x0 [0153.155] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e64c | out: ppvObject=0x18e64c*=0xffa0a4) returned 0x0 [0153.155] WbemLocator:IRpcOptions:Query (in: This=0xffa0a4, pPrx=0xffa0c0, dwProperty=2, pdwValue=0x18e658 | out: pdwValue=0x18e658) returned 0x80004002 [0153.155] WbemLocator:IUnknown:Release (This=0xffa0a4) returned 0x3 [0153.156] WbemLocator:IUnknown:Release (This=0xffa0c0) returned 0x2 [0153.156] CoGetContextToken (in: pToken=0x18eba0 | out: pToken=0x18eba0) returned 0x0 [0153.156] CoGetContextToken (in: pToken=0x18eb00 | out: pToken=0x18eb00) returned 0x0 [0153.156] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x18ebd0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18ebcc | out: ppvObject=0x18ebcc*=0xfdc7d8) returned 0x0 [0153.156] IUnknown:AddRef (This=0xfdc7d8) returned 0x4 [0153.156] IUnknown:Release (This=0xfdc7d8) returned 0x3 [0153.156] IUnknown:Release (This=0xfdc7d8) returned 0x2 [0153.156] WbemLocator:IUnknown:Release (This=0xfbbe70) returned 0x2 [0153.156] SysStringLen (param_1=0x0) returned 0x0 [0153.156] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfdbb90, puCount=0x18ee54 | out: puCount=0x18ee54*=0x2) returned 0x0 [0153.156] WbemDefPath:IWbemPath:GetText (in: This=0xfdbb90, lFlags=4, puBuffLength=0x18ee50*=0x0, pszText=0x0 | out: puBuffLength=0x18ee50*=0xf, pszText=0x0) returned 0x0 [0153.156] WbemDefPath:IWbemPath:GetText (in: This=0xfdbb90, lFlags=4, puBuffLength=0x18ee50*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0153.156] CoGetContextToken (in: pToken=0x18ec98 | out: pToken=0x18ec98) returned 0x0 [0153.156] IUnknown:AddRef (This=0xfdc7d8) returned 0x3 [0153.157] IEnumWbemClassObject:Clone (in: This=0xfdc7d8, ppEnum=0x18ee54 | out: ppEnum=0x18ee54*=0xffe538) returned 0x0 [0153.159] IUnknown:QueryInterface (in: This=0xffe538, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed10 | out: ppvObject=0x18ed10*=0xffe53c) returned 0x0 [0153.159] IClientSecurity:QueryBlanket (in: This=0xffe53c, pProxy=0xffe538, pAuthnSvc=0x18ed60, pAuthzSvc=0x18ed5c, pServerPrincName=0x18ed54, pAuthnLevel=0x18ed58, pImpLevel=0x18ed48, pAuthInfo=0x18ed4c, pCapabilites=0x18ed50 | out: pAuthnSvc=0x18ed60*=0xa, pAuthzSvc=0x18ed5c*=0x0, pServerPrincName=0x18ed54, pAuthnLevel=0x18ed58*=0x6, pImpLevel=0x18ed48*=0x2, pAuthInfo=0x18ed4c, pCapabilites=0x18ed50*=0x1) returned 0x0 [0153.159] IUnknown:Release (This=0xffe53c) returned 0x1 [0153.159] IUnknown:QueryInterface (in: This=0xffe538, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed04 | out: ppvObject=0x18ed04*=0xff9bc0) returned 0x0 [0153.159] IUnknown:QueryInterface (in: This=0xffe538, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecf0 | out: ppvObject=0x18ecf0*=0xffe53c) returned 0x0 [0153.159] IClientSecurity:SetBlanket (This=0xffe53c, pProxy=0xffe538, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0153.162] IUnknown:Release (This=0xffe53c) returned 0x2 [0153.162] WbemLocator:IUnknown:Release (This=0xff9bc0) returned 0x1 [0153.162] CoTaskMemFree (pv=0xff2d18) [0153.163] IUnknown:QueryInterface (in: This=0xffe538, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8ec | out: ppvObject=0x18e8ec*=0xff9bc0) returned 0x0 [0153.163] WbemLocator:IUnknown:QueryInterface (in: This=0xff9bc0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e8a8 | out: ppvObject=0x18e8a8*=0x0) returned 0x80004002 [0153.163] WbemLocator:IUnknown:QueryInterface (in: This=0xff9bc0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e6c4 | out: ppvObject=0x18e6c4*=0x0) returned 0x80004002 [0153.164] IUnknown:QueryInterface (in: This=0xffe538, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e49c | out: ppvObject=0x18e49c*=0x0) returned 0x80004002 [0153.165] WbemLocator:IUnknown:AddRef (This=0xff9bc0) returned 0x3 [0153.165] WbemLocator:IUnknown:QueryInterface (in: This=0xff9bc0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e1fc | out: ppvObject=0x18e1fc*=0x0) returned 0x80004002 [0153.165] WbemLocator:IUnknown:QueryInterface (in: This=0xff9bc0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e1ac | out: ppvObject=0x18e1ac*=0x0) returned 0x80004002 [0153.165] WbemLocator:IUnknown:QueryInterface (in: This=0xff9bc0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1b8 | out: ppvObject=0x18e1b8*=0xff9b1c) returned 0x0 [0153.165] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff9b1c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e1c0 | out: pCid=0x18e1c0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.165] WbemLocator:IUnknown:Release (This=0xff9b1c) returned 0x3 [0153.165] CoGetContextToken (in: pToken=0x18e218 | out: pToken=0x18e218) returned 0x0 [0153.165] CoGetContextToken (in: pToken=0x18e620 | out: pToken=0x18e620) returned 0x0 [0153.165] WbemLocator:IUnknown:QueryInterface (in: This=0xff9bc0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6ac | out: ppvObject=0x18e6ac*=0xff9ba4) returned 0x0 [0153.165] WbemLocator:IRpcOptions:Query (in: This=0xff9ba4, pPrx=0xff9bc0, dwProperty=2, pdwValue=0x18e6b8 | out: pdwValue=0x18e6b8) returned 0x80004002 [0153.165] WbemLocator:IUnknown:Release (This=0xff9ba4) returned 0x3 [0153.165] WbemLocator:IUnknown:Release (This=0xff9bc0) returned 0x2 [0153.166] CoGetContextToken (in: pToken=0x18ec00 | out: pToken=0x18ec00) returned 0x0 [0153.166] CoGetContextToken (in: pToken=0x18eb60 | out: pToken=0x18eb60) returned 0x0 [0153.166] WbemLocator:IUnknown:QueryInterface (in: This=0xff9bc0, riid=0x18ec30*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18ec2c | out: ppvObject=0x18ec2c*=0xffe538) returned 0x0 [0153.166] IUnknown:AddRef (This=0xffe538) returned 0x4 [0153.166] IUnknown:Release (This=0xffe538) returned 0x3 [0153.166] IUnknown:Release (This=0xffe538) returned 0x2 [0153.166] IUnknown:Release (This=0xfdc7d8) returned 0x2 [0153.166] SysStringLen (param_1=0x0) returned 0x0 [0153.166] IEnumWbemClassObject:Reset (This=0xffe538) returned 0x0 [0153.170] CoTaskMemAlloc (cb=0x4) returned 0xfdc400 [0153.170] IEnumWbemClassObject:Next (in: This=0xffe538, lTimeout=-1, uCount=0x1, apObjects=0xfdc400, puReturned=0x275172c | out: apObjects=0xfdc400*=0x1002cd0, puReturned=0x275172c*=0x1) returned 0x0 [0153.176] IUnknown:QueryInterface (in: This=0x1002cd0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e4b0 | out: ppvObject=0x18e4b0*=0x1002cd0) returned 0x0 [0153.177] IUnknown:QueryInterface (in: This=0x1002cd0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e46c | out: ppvObject=0x18e46c*=0x0) returned 0x80004002 [0153.177] IUnknown:QueryInterface (in: This=0x1002cd0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e28c | out: ppvObject=0x18e28c*=0x0) returned 0x80004002 [0153.177] IUnknown:QueryInterface (in: This=0x1002cd0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e064 | out: ppvObject=0x18e064*=0x0) returned 0x80004002 [0153.177] IUnknown:AddRef (This=0x1002cd0) returned 0x3 [0153.177] IUnknown:QueryInterface (in: This=0x1002cd0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18ddc4 | out: ppvObject=0x18ddc4*=0x0) returned 0x80004002 [0153.177] IUnknown:QueryInterface (in: This=0x1002cd0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd74 | out: ppvObject=0x18dd74*=0x0) returned 0x80004002 [0153.177] IUnknown:QueryInterface (in: This=0x1002cd0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dd80 | out: ppvObject=0x18dd80*=0x1002cd4) returned 0x0 [0153.177] IMarshal:GetUnmarshalClass (in: This=0x1002cd4, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd88 | out: pCid=0x18dd88*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0153.177] IUnknown:Release (This=0x1002cd4) returned 0x3 [0153.177] CoGetContextToken (in: pToken=0x18dde0 | out: pToken=0x18dde0) returned 0x0 [0153.177] CoGetContextToken (in: pToken=0x18e1e8 | out: pToken=0x18e1e8) returned 0x0 [0153.177] IUnknown:QueryInterface (in: This=0x1002cd0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e274 | out: ppvObject=0x18e274*=0x0) returned 0x80004002 [0153.178] IUnknown:Release (This=0x1002cd0) returned 0x2 [0153.178] CoGetContextToken (in: pToken=0x18e7c0 | out: pToken=0x18e7c0) returned 0x0 [0153.178] CoGetContextToken (in: pToken=0x18e720 | out: pToken=0x18e720) returned 0x0 [0153.178] IUnknown:QueryInterface (in: This=0x1002cd0, riid=0x18e7f0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e7ec | out: ppvObject=0x18e7ec*=0x1002cd0) returned 0x0 [0153.178] IUnknown:AddRef (This=0x1002cd0) returned 0x4 [0153.178] IUnknown:Release (This=0x1002cd0) returned 0x3 [0153.178] IUnknown:Release (This=0x1002cd0) returned 0x2 [0153.179] CoTaskMemFree (pv=0xfdc400) [0153.179] CoGetContextToken (in: pToken=0x18eb30 | out: pToken=0x18eb30) returned 0x0 [0153.179] IUnknown:AddRef (This=0x1002cd0) returned 0x3 [0153.179] IWbemClassObject:Get (in: This=0x1002cd0, wszName="__GENUS", lFlags=0, pVal=0x18ee44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eec4*=0, plFlavor=0x18eec0*=0 | out: pVal=0x18ee44*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eec4*=3, plFlavor=0x18eec0*=64) returned 0x0 [0153.179] IWbemClassObject:Get (in: This=0x1002cd0, wszName="__PATH", lFlags=0, pVal=0x18ee28*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eeac*=0, plFlavor=0x18eea8*=0 | out: pVal=0x18ee28*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_BaseBoard.Tag=\"Base Board\"", varVal2=0x0), pType=0x18eeac*=8, plFlavor=0x18eea8*=64) returned 0x0 [0153.179] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_BaseBoard.Tag=\"Base Board\"") returned 0x68 [0153.179] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_BaseBoard.Tag=\"Base Board\"") returned 0x68 [0153.180] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x408 [0153.180] SetEvent (hEvent=0x30c) returned 1 [0153.180] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ee00*=0x408, lpdwindex=0x18ec1c | out: lpdwindex=0x18ec1c) returned 0x0 [0153.182] CoGetContextToken (in: pToken=0x18ecd0 | out: pToken=0x18ecd0) returned 0x0 [0153.182] CoGetContextToken (in: pToken=0x18ec30 | out: pToken=0x18ec30) returned 0x0 [0153.183] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdbc0, riid=0x18ed00*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ecfc | out: ppvObject=0x18ecfc*=0xffdbc0) returned 0x0 [0153.183] WbemDefPath:IUnknown:AddRef (This=0xffdbc0) returned 0x3 [0153.183] WbemDefPath:IUnknown:Release (This=0xffdbc0) returned 0x2 [0153.183] WbemDefPath:IWbemPath:SetText (This=0xffdbc0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_BaseBoard.Tag=\"Base Board\"") returned 0x0 [0153.183] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfdbb90, puCount=0x18ee80 | out: puCount=0x18ee80*=0x2) returned 0x0 [0153.183] WbemDefPath:IWbemPath:GetText (in: This=0xfdbb90, lFlags=4, puBuffLength=0x18ee7c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee7c*=0xf, pszText=0x0) returned 0x0 [0153.183] WbemDefPath:IWbemPath:GetText (in: This=0xfdbb90, lFlags=4, puBuffLength=0x18ee7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0153.183] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfdbb90, puCount=0x18ee4c | out: puCount=0x18ee4c*=0x2) returned 0x0 [0153.183] WbemDefPath:IWbemPath:GetText (in: This=0xfdbb90, lFlags=4, puBuffLength=0x18ee48*=0x0, pszText=0x0 | out: puBuffLength=0x18ee48*=0xf, pszText=0x0) returned 0x0 [0153.183] WbemDefPath:IWbemPath:GetText (in: This=0xfdbb90, lFlags=4, puBuffLength=0x18ee48*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee48*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0153.184] IWbemClassObject:Get (in: This=0x1002cd0, wszName="SerialNumber", lFlags=0, pVal=0x18ee48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2751fd0*=0, plFlavor=0x2751fd4*=0 | out: pVal=0x18ee48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="..XXXXXXXXXXXXX.", varVal2=0x0), pType=0x2751fd0*=8, plFlavor=0x2751fd4*=0) returned 0x0 [0153.184] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0153.184] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0153.185] IWbemClassObject:Get (in: This=0x1002cd0, wszName="SerialNumber", lFlags=0, pVal=0x18ee50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2751fd0*=8, plFlavor=0x2751fd4*=0 | out: pVal=0x18ee50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="..XXXXXXXXXXXXX.", varVal2=0x0), pType=0x2751fd0*=8, plFlavor=0x2751fd4*=0) returned 0x0 [0153.185] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0153.185] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0153.189] CoTaskMemAlloc (cb=0x4) returned 0xfdc350 [0153.189] IEnumWbemClassObject:Next (in: This=0xffe538, lTimeout=-1, uCount=0x1, apObjects=0xfdc350, puReturned=0x275172c | out: apObjects=0xfdc350*=0x0, puReturned=0x275172c*=0x0) returned 0x1 [0153.194] CoTaskMemFree (pv=0xfdc350) [0153.194] CoGetContextToken (in: pToken=0x18ed78 | out: pToken=0x18ed78) returned 0x0 [0153.194] WbemLocator:IUnknown:Release (This=0xff9bc0) returned 0x1 [0153.194] IUnknown:Release (This=0xffe538) returned 0x0 [0153.246] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x40c [0153.246] SetEvent (hEvent=0x30c) returned 1 [0153.246] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ee24*=0x40c, lpdwindex=0x18ec44 | out: lpdwindex=0x18ec44) returned 0x0 [0153.249] CoGetContextToken (in: pToken=0x18ecf0 | out: pToken=0x18ecf0) returned 0x0 [0153.249] CoGetContextToken (in: pToken=0x18ec50 | out: pToken=0x18ec50) returned 0x0 [0153.249] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdc30, riid=0x18ed20*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ed1c | out: ppvObject=0x18ed1c*=0xffdc30) returned 0x0 [0153.249] WbemDefPath:IUnknown:AddRef (This=0xffdc30) returned 0x3 [0153.249] WbemDefPath:IUnknown:Release (This=0xffdc30) returned 0x2 [0153.249] WbemDefPath:IWbemPath:SetText (This=0xffdc30, uMode=0x4, pszPath="win32_processor") returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdc30, puCount=0x18eea4 | out: puCount=0x18eea4*=0x0) returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetText (in: This=0xffdc30, lFlags=2, puBuffLength=0x18eea0*=0x0, pszText=0x0 | out: puBuffLength=0x18eea0*=0x10, pszText=0x0) returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetText (in: This=0xffdc30, lFlags=2, puBuffLength=0x18eea0*=0x10, pszText="000000000000000" | out: puBuffLength=0x18eea0*=0x10, pszText="win32_processor") returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetInfo (in: This=0xffdc30, uRequestedInfo=0x0, puResponse=0x18eeac | out: puResponse=0x18eeac*=0xc15) returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdc30, puCount=0x18eea4 | out: puCount=0x18eea4*=0x0) returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetInfo (in: This=0xffdc30, uRequestedInfo=0x0, puResponse=0x18eeac | out: puResponse=0x18eeac*=0xc15) returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdc30, puCount=0x18ee94 | out: puCount=0x18ee94*=0x0) returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetText (in: This=0xffdc30, lFlags=2, puBuffLength=0x18ee90*=0x0, pszText=0x0 | out: puBuffLength=0x18ee90*=0x10, pszText=0x0) returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetText (in: This=0xffdc30, lFlags=2, puBuffLength=0x18ee90*=0x10, pszText="000000000000000" | out: puBuffLength=0x18ee90*=0x10, pszText="win32_processor") returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdc30, puCount=0x18ee94 | out: puCount=0x18ee94*=0x0) returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetText (in: This=0xffdc30, lFlags=2, puBuffLength=0x18ee90*=0x0, pszText=0x0 | out: puBuffLength=0x18ee90*=0x10, pszText=0x0) returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetText (in: This=0xffdc30, lFlags=2, puBuffLength=0x18ee90*=0x10, pszText="000000000000000" | out: puBuffLength=0x18ee90*=0x10, pszText="win32_processor") returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdc30, puCount=0x18ee24 | out: puCount=0x18ee24*=0x0) returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee10 | out: puCount=0x18ee10*=0x2) returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee0c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee0c*=0xf, pszText=0x0) returned 0x0 [0153.250] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0153.250] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x410 [0153.250] SetEvent (hEvent=0x30c) returned 1 [0153.250] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed6c*=0x410, lpdwindex=0x18eb8c | out: lpdwindex=0x18eb8c) returned 0x0 [0153.253] CoGetContextToken (in: pToken=0x18ec38 | out: pToken=0x18ec38) returned 0x0 [0153.253] CoGetContextToken (in: pToken=0x18eb98 | out: pToken=0x18eb98) returned 0x0 [0153.253] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd680, riid=0x18ec68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xffd680) returned 0x0 [0153.254] WbemDefPath:IUnknown:AddRef (This=0xffd680) returned 0x3 [0153.254] WbemDefPath:IUnknown:Release (This=0xffd680) returned 0x2 [0153.254] WbemDefPath:IWbemPath:SetText (This=0xffd680, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0153.254] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffd680, puCount=0x18ede8 | out: puCount=0x18ede8*=0x2) returned 0x0 [0153.254] WbemDefPath:IWbemPath:GetText (in: This=0xffd680, lFlags=4, puBuffLength=0x18ede4*=0x0, pszText=0x0 | out: puBuffLength=0x18ede4*=0xf, pszText=0x0) returned 0x0 [0153.254] WbemDefPath:IWbemPath:GetText (in: This=0xffd680, lFlags=4, puBuffLength=0x18ede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0153.278] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed08*=0x424, lpdwindex=0x18ebbc | out: lpdwindex=0x18ebbc) returned 0x0 [0153.365] CoGetContextToken (in: pToken=0x18eb00 | out: pToken=0x18eb00) returned 0x0 [0153.365] CoGetContextToken (in: pToken=0x18eaa8 | out: pToken=0x18eaa8) returned 0x0 [0153.365] IUnknown:QueryInterface (in: This=0xfb21f0, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea84 | out: ppvObject=0x18ea84*=0xfb2200) returned 0x0 [0153.366] CObjectContext::ContextCallback () returned 0x0 [0153.368] IUnknown:Release (This=0xfb2200) returned 0x1 [0153.368] CoUnmarshalInterface (in: pStm=0xff2480, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eaf4 | out: ppv=0x18eaf4*=0xff8ec0) returned 0x0 [0153.368] CoMarshalInterface (pStm=0xff2480, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff8ec0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0153.369] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e994 | out: ppvObject=0x18e994*=0xff8ec0) returned 0x0 [0153.369] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e950 | out: ppvObject=0x18e950*=0x0) returned 0x80004002 [0153.370] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e76c | out: ppvObject=0x18e76c*=0x0) returned 0x80004002 [0153.370] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e544 | out: ppvObject=0x18e544*=0x0) returned 0x80004002 [0153.371] WbemLocator:IUnknown:AddRef (This=0xff8ec0) returned 0x3 [0153.371] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e2a4 | out: ppvObject=0x18e2a4*=0x0) returned 0x80004002 [0153.371] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e254 | out: ppvObject=0x18e254*=0x0) returned 0x80004002 [0153.371] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e260 | out: ppvObject=0x18e260*=0xff8e1c) returned 0x0 [0153.372] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff8e1c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e268 | out: pCid=0x18e268*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.372] WbemLocator:IUnknown:Release (This=0xff8e1c) returned 0x3 [0153.372] CoGetContextToken (in: pToken=0x18e2c0 | out: pToken=0x18e2c0) returned 0x0 [0153.372] CoGetContextToken (in: pToken=0x18e6c8 | out: pToken=0x18e6c8) returned 0x0 [0153.372] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e754 | out: ppvObject=0x18e754*=0xff8ea4) returned 0x0 [0153.372] WbemLocator:IRpcOptions:Query (in: This=0xff8ea4, pPrx=0xff8ec0, dwProperty=2, pdwValue=0x18e760 | out: pdwValue=0x18e760) returned 0x0 [0153.372] WbemLocator:IUnknown:Release (This=0xff8ea4) returned 0x3 [0153.372] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x2 [0153.372] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x1 [0153.372] CoGetContextToken (in: pToken=0x18ea40 | out: pToken=0x18ea40) returned 0x0 [0153.372] WbemLocator:IUnknown:AddRef (This=0xff8ec0) returned 0x2 [0153.372] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecf8 | out: ppvObject=0x18ecf8*=0xff8e9c) returned 0x0 [0153.373] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff8e9c, pProxy=0xff8ec0, pAuthnSvc=0x18ed48, pAuthzSvc=0x18ed44, pServerPrincName=0x18ed3c, pAuthnLevel=0x18ed40, pImpLevel=0x18ed30, pAuthInfo=0x18ed34, pCapabilites=0x18ed38 | out: pAuthnSvc=0x18ed48*=0xa, pAuthzSvc=0x18ed44*=0x0, pServerPrincName=0x18ed3c, pAuthnLevel=0x18ed40*=0x6, pImpLevel=0x18ed30*=0x2, pAuthInfo=0x18ed34, pCapabilites=0x18ed38*=0x1) returned 0x0 [0153.373] WbemLocator:IUnknown:Release (This=0xff8e9c) returned 0x2 [0153.373] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecec | out: ppvObject=0x18ecec*=0xff8ec0) returned 0x0 [0153.373] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecd8 | out: ppvObject=0x18ecd8*=0xff8e9c) returned 0x0 [0153.373] WbemLocator:IClientSecurity:SetBlanket (This=0xff8e9c, pProxy=0xff8ec0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0153.373] WbemLocator:IUnknown:Release (This=0xff8e9c) returned 0x3 [0153.373] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x2 [0153.373] CoTaskMemFree (pv=0xff2d78) [0153.373] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x1 [0153.373] SysStringLen (param_1=0x0) returned 0x0 [0153.374] CoGetContextToken (in: pToken=0x18ecb8 | out: pToken=0x18ecb8) returned 0x0 [0153.374] CoGetContextToken (in: pToken=0x18ec18 | out: pToken=0x18ec18) returned 0x0 [0153.374] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x18ece8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18ece4 | out: ppvObject=0x18ece4*=0x1001338) returned 0x0 [0153.374] WbemLocator:IUnknown:AddRef (This=0x1001338) returned 0x3 [0153.374] WbemLocator:IUnknown:Release (This=0x1001338) returned 0x2 [0153.374] CoGetContextToken (in: pToken=0x18ec78 | out: pToken=0x18ec78) returned 0x0 [0153.374] WbemLocator:IUnknown:AddRef (This=0x1001338) returned 0x3 [0153.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1001338, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecf8 | out: ppvObject=0x18ecf8*=0xff8e9c) returned 0x0 [0153.375] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff8e9c, pProxy=0x1001338, pAuthnSvc=0x18ed48, pAuthzSvc=0x18ed44, pServerPrincName=0x18ed3c, pAuthnLevel=0x18ed40, pImpLevel=0x18ed30, pAuthInfo=0x18ed34, pCapabilites=0x18ed38 | out: pAuthnSvc=0x18ed48*=0xa, pAuthzSvc=0x18ed44*=0x0, pServerPrincName=0x18ed3c, pAuthnLevel=0x18ed40*=0x6, pImpLevel=0x18ed30*=0x2, pAuthInfo=0x18ed34, pCapabilites=0x18ed38*=0x1) returned 0x0 [0153.375] WbemLocator:IUnknown:Release (This=0xff8e9c) returned 0x3 [0153.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1001338, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecec | out: ppvObject=0x18ecec*=0xff8ec0) returned 0x0 [0153.375] WbemLocator:IUnknown:QueryInterface (in: This=0x1001338, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecd8 | out: ppvObject=0x18ecd8*=0xff8e9c) returned 0x0 [0153.375] WbemLocator:IClientSecurity:SetBlanket (This=0xff8e9c, pProxy=0x1001338, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0153.375] WbemLocator:IUnknown:Release (This=0xff8e9c) returned 0x4 [0153.375] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x3 [0153.375] CoTaskMemFree (pv=0xff2d78) [0153.376] WbemLocator:IUnknown:Release (This=0x1001338) returned 0x2 [0153.376] SysStringLen (param_1=0x0) returned 0x0 [0153.376] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffd680, puCount=0x18ee0c | out: puCount=0x18ee0c*=0x2) returned 0x0 [0153.376] WbemDefPath:IWbemPath:GetText (in: This=0xffd680, lFlags=4, puBuffLength=0x18ee08*=0x0, pszText=0x0 | out: puBuffLength=0x18ee08*=0xf, pszText=0x0) returned 0x0 [0153.376] WbemDefPath:IWbemPath:GetText (in: This=0xffd680, lFlags=4, puBuffLength=0x18ee08*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee08*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0153.376] CoGetContextToken (in: pToken=0x18ea78 | out: pToken=0x18ea78) returned 0x0 [0153.376] CoUnmarshalInterface (in: pStm=0xff2480, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ea6c | out: ppv=0x18ea6c*=0xff8ec0) returned 0x0 [0153.376] CoMarshalInterface (pStm=0xff2480, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff8ec0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0153.377] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e90c | out: ppvObject=0x18e90c*=0xff8ec0) returned 0x0 [0153.377] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x3 [0153.377] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x2 [0153.377] CoGetContextToken (in: pToken=0x18e9b8 | out: pToken=0x18e9b8) returned 0x0 [0153.377] WbemLocator:IUnknown:AddRef (This=0xff8ec0) returned 0x3 [0153.377] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec70 | out: ppvObject=0x18ec70*=0xff8e9c) returned 0x0 [0153.377] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff8e9c, pProxy=0xff8ec0, pAuthnSvc=0x18ecc0, pAuthzSvc=0x18ecbc, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8, pImpLevel=0x18eca8, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0 | out: pAuthnSvc=0x18ecc0*=0xa, pAuthzSvc=0x18ecbc*=0x0, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8*=0x6, pImpLevel=0x18eca8*=0x3, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0*=0x20) returned 0x0 [0153.377] WbemLocator:IUnknown:Release (This=0xff8e9c) returned 0x3 [0153.377] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xff8ec0) returned 0x0 [0153.377] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec50 | out: ppvObject=0x18ec50*=0xff8e9c) returned 0x0 [0153.378] WbemLocator:IClientSecurity:SetBlanket (This=0xff8e9c, pProxy=0xff8ec0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0153.378] WbemLocator:IUnknown:Release (This=0xff8e9c) returned 0x4 [0153.378] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x3 [0153.378] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x2 [0153.378] SysStringLen (param_1=0x0) returned 0x0 [0153.378] CoGetContextToken (in: pToken=0x18ec30 | out: pToken=0x18ec30) returned 0x0 [0153.378] WbemLocator:IUnknown:AddRef (This=0x1001338) returned 0x3 [0153.378] WbemLocator:IUnknown:Release (This=0x1001338) returned 0x2 [0153.378] CoGetContextToken (in: pToken=0x18ebf0 | out: pToken=0x18ebf0) returned 0x0 [0153.378] WbemLocator:IUnknown:AddRef (This=0x1001338) returned 0x3 [0153.378] WbemLocator:IUnknown:QueryInterface (in: This=0x1001338, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec70 | out: ppvObject=0x18ec70*=0xff8e9c) returned 0x0 [0153.379] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff8e9c, pProxy=0x1001338, pAuthnSvc=0x18ecc0, pAuthzSvc=0x18ecbc, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8, pImpLevel=0x18eca8, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0 | out: pAuthnSvc=0x18ecc0*=0xa, pAuthzSvc=0x18ecbc*=0x0, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8*=0x6, pImpLevel=0x18eca8*=0x3, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0*=0x20) returned 0x0 [0153.379] WbemLocator:IUnknown:Release (This=0xff8e9c) returned 0x3 [0153.379] WbemLocator:IUnknown:QueryInterface (in: This=0x1001338, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xff8ec0) returned 0x0 [0153.379] WbemLocator:IUnknown:QueryInterface (in: This=0x1001338, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec50 | out: ppvObject=0x18ec50*=0xff8e9c) returned 0x0 [0153.379] WbemLocator:IClientSecurity:SetBlanket (This=0xff8e9c, pProxy=0x1001338, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0153.379] WbemLocator:IUnknown:Release (This=0xff8e9c) returned 0x4 [0153.379] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x3 [0153.380] WbemLocator:IUnknown:Release (This=0x1001338) returned 0x2 [0153.380] SysStringLen (param_1=0x0) returned 0x0 [0153.380] WbemDefPath:IWbemPath:GetText (in: This=0xffdc30, lFlags=2, puBuffLength=0x18ee10*=0x0, pszText=0x0 | out: puBuffLength=0x18ee10*=0x10, pszText=0x0) returned 0x0 [0153.380] WbemDefPath:IWbemPath:GetText (in: This=0xffdc30, lFlags=2, puBuffLength=0x18ee10*=0x10, pszText="000000000000000" | out: puBuffLength=0x18ee10*=0x10, pszText="win32_processor") returned 0x0 [0153.380] IWbemServices:GetObject (in: This=0x1001338, strObjectPath="win32_processor", lFlags=0, pCtx=0x0, ppObject=0x18edc4*=0x0, ppCallResult=0x0 | out: ppObject=0x18edc4*=0x10037d8, ppCallResult=0x0) returned 0x0 [0153.394] IWbemClassObject:Get (in: This=0x10037d8, wszName="__PATH", lFlags=0, pVal=0x18edac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee54*=0, plFlavor=0x18ee50*=0 | out: pVal=0x18edac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor", varVal2=0x0), pType=0x18ee54*=8, plFlavor=0x18ee50*=64) returned 0x0 [0153.394] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x46 [0153.394] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x46 [0153.394] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x428 [0153.394] SetEvent (hEvent=0x30c) returned 1 [0153.395] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed68*=0x428, lpdwindex=0x18eb84 | out: lpdwindex=0x18eb84) returned 0x0 [0153.399] CoGetContextToken (in: pToken=0x18ec38 | out: pToken=0x18ec38) returned 0x0 [0153.399] CoGetContextToken (in: pToken=0x18eb98 | out: pToken=0x18eb98) returned 0x0 [0153.399] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdca0, riid=0x18ec68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xffdca0) returned 0x0 [0153.399] WbemDefPath:IUnknown:AddRef (This=0xffdca0) returned 0x3 [0153.399] WbemDefPath:IUnknown:Release (This=0xffdca0) returned 0x2 [0153.399] WbemDefPath:IWbemPath:SetText (This=0xffdca0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x0 [0153.400] IWbemClassObject:Get (in: This=0x10037d8, wszName="__CLASS", lFlags=0, pVal=0x18ee1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee9c*=0, plFlavor=0x18ee98*=0 | out: pVal=0x18ee1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Processor", varVal2=0x0), pType=0x18ee9c*=8, plFlavor=0x18ee98*=64) returned 0x0 [0153.400] SysStringByteLen (bstr="Win32_Processor") returned 0x1e [0153.400] SysStringByteLen (bstr="Win32_Processor") returned 0x1e [0153.400] CoGetContextToken (in: pToken=0x18ec38 | out: pToken=0x18ec38) returned 0x0 [0153.400] WbemLocator:IUnknown:AddRef (This=0x1001338) returned 0x3 [0153.400] IWbemServices:CreateInstanceEnum (in: This=0x1001338, strFilter="Win32_Processor", lFlags=17, pCtx=0x0, ppEnum=0x18ee18 | out: ppEnum=0x18ee18*=0xffea78) returned 0x0 [0153.403] IUnknown:QueryInterface (in: This=0xffea78, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18eca4 | out: ppvObject=0x18eca4*=0xffea7c) returned 0x0 [0153.403] IClientSecurity:QueryBlanket (in: This=0xffea7c, pProxy=0xffea78, pAuthnSvc=0x18ecf4, pAuthzSvc=0x18ecf0, pServerPrincName=0x18ece8, pAuthnLevel=0x18ecec, pImpLevel=0x18ecdc, pAuthInfo=0x18ece0, pCapabilites=0x18ece4 | out: pAuthnSvc=0x18ecf4*=0xa, pAuthzSvc=0x18ecf0*=0x0, pServerPrincName=0x18ece8, pAuthnLevel=0x18ecec*=0x6, pImpLevel=0x18ecdc*=0x2, pAuthInfo=0x18ece0, pCapabilites=0x18ece4*=0x1) returned 0x0 [0153.403] IUnknown:Release (This=0xffea7c) returned 0x1 [0153.403] IUnknown:QueryInterface (in: This=0xffea78, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec98 | out: ppvObject=0x18ec98*=0xffa4c0) returned 0x0 [0153.403] IUnknown:QueryInterface (in: This=0xffea78, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec84 | out: ppvObject=0x18ec84*=0xffea7c) returned 0x0 [0153.403] IClientSecurity:SetBlanket (This=0xffea7c, pProxy=0xffea78, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0153.421] IUnknown:Release (This=0xffea7c) returned 0x2 [0153.421] WbemLocator:IUnknown:Release (This=0xffa4c0) returned 0x1 [0153.421] CoTaskMemFree (pv=0xff2d78) [0153.421] IUnknown:QueryInterface (in: This=0xffea78, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e88c | out: ppvObject=0x18e88c*=0xffa4c0) returned 0x0 [0153.421] WbemLocator:IUnknown:QueryInterface (in: This=0xffa4c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e848 | out: ppvObject=0x18e848*=0x0) returned 0x80004002 [0153.477] WbemLocator:IUnknown:QueryInterface (in: This=0xffa4c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e664 | out: ppvObject=0x18e664*=0x0) returned 0x80004002 [0153.485] IUnknown:QueryInterface (in: This=0xffea78, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e43c | out: ppvObject=0x18e43c*=0x0) returned 0x80004002 [0153.538] WbemLocator:IUnknown:AddRef (This=0xffa4c0) returned 0x3 [0153.538] WbemLocator:IUnknown:QueryInterface (in: This=0xffa4c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e19c | out: ppvObject=0x18e19c*=0x0) returned 0x80004002 [0153.538] WbemLocator:IUnknown:QueryInterface (in: This=0xffa4c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e14c | out: ppvObject=0x18e14c*=0x0) returned 0x80004002 [0153.539] WbemLocator:IUnknown:QueryInterface (in: This=0xffa4c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e158 | out: ppvObject=0x18e158*=0xffa41c) returned 0x0 [0153.539] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xffa41c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e160 | out: pCid=0x18e160*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.539] WbemLocator:IUnknown:Release (This=0xffa41c) returned 0x3 [0153.539] CoGetContextToken (in: pToken=0x18e1b8 | out: pToken=0x18e1b8) returned 0x0 [0153.539] CoGetContextToken (in: pToken=0x18e5c0 | out: pToken=0x18e5c0) returned 0x0 [0153.539] WbemLocator:IUnknown:QueryInterface (in: This=0xffa4c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e64c | out: ppvObject=0x18e64c*=0xffa4a4) returned 0x0 [0153.539] WbemLocator:IRpcOptions:Query (in: This=0xffa4a4, pPrx=0xffa4c0, dwProperty=2, pdwValue=0x18e658 | out: pdwValue=0x18e658) returned 0x80004002 [0153.539] WbemLocator:IUnknown:Release (This=0xffa4a4) returned 0x3 [0153.539] WbemLocator:IUnknown:Release (This=0xffa4c0) returned 0x2 [0153.539] CoGetContextToken (in: pToken=0x18eba0 | out: pToken=0x18eba0) returned 0x0 [0153.539] CoGetContextToken (in: pToken=0x18eb00 | out: pToken=0x18eb00) returned 0x0 [0153.539] WbemLocator:IUnknown:QueryInterface (in: This=0xffa4c0, riid=0x18ebd0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18ebcc | out: ppvObject=0x18ebcc*=0xffea78) returned 0x0 [0153.540] IUnknown:AddRef (This=0xffea78) returned 0x4 [0153.540] IUnknown:Release (This=0xffea78) returned 0x3 [0153.540] IUnknown:Release (This=0xffea78) returned 0x2 [0153.540] WbemLocator:IUnknown:Release (This=0x1001338) returned 0x2 [0153.540] SysStringLen (param_1=0x0) returned 0x0 [0153.540] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffd680, puCount=0x18ee54 | out: puCount=0x18ee54*=0x2) returned 0x0 [0153.540] WbemDefPath:IWbemPath:GetText (in: This=0xffd680, lFlags=4, puBuffLength=0x18ee50*=0x0, pszText=0x0 | out: puBuffLength=0x18ee50*=0xf, pszText=0x0) returned 0x0 [0153.540] WbemDefPath:IWbemPath:GetText (in: This=0xffd680, lFlags=4, puBuffLength=0x18ee50*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0153.598] CoGetContextToken (in: pToken=0x18ec70 | out: pToken=0x18ec70) returned 0x0 [0153.598] IUnknown:AddRef (This=0xffea78) returned 0x3 [0153.598] IEnumWbemClassObject:Clone (in: This=0xffea78, ppEnum=0x18ee2c | out: ppEnum=0x18ee2c*=0x1003a58) returned 0x0 [0153.642] IUnknown:QueryInterface (in: This=0x1003a58, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ece8 | out: ppvObject=0x18ece8*=0x1003a5c) returned 0x0 [0153.642] IClientSecurity:QueryBlanket (in: This=0x1003a5c, pProxy=0x1003a58, pAuthnSvc=0x18ed38, pAuthzSvc=0x18ed34, pServerPrincName=0x18ed2c, pAuthnLevel=0x18ed30, pImpLevel=0x18ed20, pAuthInfo=0x18ed24, pCapabilites=0x18ed28 | out: pAuthnSvc=0x18ed38*=0xa, pAuthzSvc=0x18ed34*=0x0, pServerPrincName=0x18ed2c, pAuthnLevel=0x18ed30*=0x6, pImpLevel=0x18ed20*=0x2, pAuthInfo=0x18ed24, pCapabilites=0x18ed28*=0x1) returned 0x0 [0153.642] IUnknown:Release (This=0x1003a5c) returned 0x1 [0153.642] IUnknown:QueryInterface (in: This=0x1003a58, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecdc | out: ppvObject=0x18ecdc*=0xff8dc0) returned 0x0 [0153.642] IUnknown:QueryInterface (in: This=0x1003a58, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecc8 | out: ppvObject=0x18ecc8*=0x1003a5c) returned 0x0 [0153.642] IClientSecurity:SetBlanket (This=0x1003a5c, pProxy=0x1003a58, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0153.727] IUnknown:Release (This=0x1003a5c) returned 0x2 [0153.727] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x1 [0153.727] CoTaskMemFree (pv=0xff2da8) [0153.727] IUnknown:QueryInterface (in: This=0x1003a58, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8c4 | out: ppvObject=0x18e8c4*=0xff8dc0) returned 0x0 [0153.727] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e880 | out: ppvObject=0x18e880*=0x0) returned 0x80004002 [0153.768] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0153.771] IUnknown:QueryInterface (in: This=0x1003a58, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e474 | out: ppvObject=0x18e474*=0x0) returned 0x80004002 [0153.779] WbemLocator:IUnknown:AddRef (This=0xff8dc0) returned 0x3 [0153.786] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0153.786] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e184 | out: ppvObject=0x18e184*=0x0) returned 0x80004002 [0153.786] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e190 | out: ppvObject=0x18e190*=0xff8d1c) returned 0x0 [0153.812] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff8d1c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e198 | out: pCid=0x18e198*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.829] WbemLocator:IUnknown:Release (This=0xff8d1c) returned 0x3 [0153.829] CoGetContextToken (in: pToken=0x18e1f0 | out: pToken=0x18e1f0) returned 0x0 [0153.830] CoGetContextToken (in: pToken=0x18e5f8 | out: pToken=0x18e5f8) returned 0x0 [0153.830] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e684 | out: ppvObject=0x18e684*=0xff8da4) returned 0x0 [0153.830] WbemLocator:IRpcOptions:Query (in: This=0xff8da4, pPrx=0xff8dc0, dwProperty=2, pdwValue=0x18e690 | out: pdwValue=0x18e690) returned 0x80004002 [0153.830] WbemLocator:IUnknown:Release (This=0xff8da4) returned 0x3 [0153.830] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x2 [0153.830] CoGetContextToken (in: pToken=0x18ebd8 | out: pToken=0x18ebd8) returned 0x0 [0153.830] CoGetContextToken (in: pToken=0x18eb38 | out: pToken=0x18eb38) returned 0x0 [0153.830] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x18ec08*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18ec04 | out: ppvObject=0x18ec04*=0x1003a58) returned 0x0 [0153.830] IUnknown:AddRef (This=0x1003a58) returned 0x4 [0153.830] IUnknown:Release (This=0x1003a58) returned 0x3 [0153.830] IUnknown:Release (This=0x1003a58) returned 0x2 [0153.830] IUnknown:Release (This=0xffea78) returned 0x2 [0153.830] SysStringLen (param_1=0x0) returned 0x0 [0153.830] IEnumWbemClassObject:Reset (This=0x1003a58) returned 0x0 [0153.884] CoTaskMemAlloc (cb=0x4) returned 0x100fc68 [0153.884] IEnumWbemClassObject:Next (in: This=0x1003a58, lTimeout=-1, uCount=0x1, apObjects=0x100fc68, puReturned=0x2753b78 | out: apObjects=0x100fc68*=0x100ed50, puReturned=0x2753b78*=0x1) returned 0x0 [0157.134] IUnknown:QueryInterface (in: This=0x100ed50, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e488 | out: ppvObject=0x18e488*=0x100ed50) returned 0x0 [0157.135] IUnknown:QueryInterface (in: This=0x100ed50, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e444 | out: ppvObject=0x18e444*=0x0) returned 0x80004002 [0157.135] IUnknown:QueryInterface (in: This=0x100ed50, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e264 | out: ppvObject=0x18e264*=0x0) returned 0x80004002 [0157.135] IUnknown:QueryInterface (in: This=0x100ed50, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e03c | out: ppvObject=0x18e03c*=0x0) returned 0x80004002 [0157.135] IUnknown:AddRef (This=0x100ed50) returned 0x3 [0157.135] IUnknown:QueryInterface (in: This=0x100ed50, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dd9c | out: ppvObject=0x18dd9c*=0x0) returned 0x80004002 [0157.135] IUnknown:QueryInterface (in: This=0x100ed50, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd4c | out: ppvObject=0x18dd4c*=0x0) returned 0x80004002 [0157.135] IUnknown:QueryInterface (in: This=0x100ed50, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dd58 | out: ppvObject=0x18dd58*=0x100ed54) returned 0x0 [0157.135] IMarshal:GetUnmarshalClass (in: This=0x100ed54, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd60 | out: pCid=0x18dd60*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.135] IUnknown:Release (This=0x100ed54) returned 0x3 [0157.135] CoGetContextToken (in: pToken=0x18ddb8 | out: pToken=0x18ddb8) returned 0x0 [0157.136] CoGetContextToken (in: pToken=0x18e1c0 | out: pToken=0x18e1c0) returned 0x0 [0157.136] IUnknown:QueryInterface (in: This=0x100ed50, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e24c | out: ppvObject=0x18e24c*=0x0) returned 0x80004002 [0157.136] IUnknown:Release (This=0x100ed50) returned 0x2 [0157.136] CoGetContextToken (in: pToken=0x18e798 | out: pToken=0x18e798) returned 0x0 [0157.136] CoGetContextToken (in: pToken=0x18e6f8 | out: pToken=0x18e6f8) returned 0x0 [0157.136] IUnknown:QueryInterface (in: This=0x100ed50, riid=0x18e7c8*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e7c4 | out: ppvObject=0x18e7c4*=0x100ed50) returned 0x0 [0157.136] IUnknown:AddRef (This=0x100ed50) returned 0x4 [0157.136] IUnknown:Release (This=0x100ed50) returned 0x3 [0157.136] IUnknown:Release (This=0x100ed50) returned 0x2 [0157.136] CoTaskMemFree (pv=0x100fc68) [0157.136] CoGetContextToken (in: pToken=0x18eb10 | out: pToken=0x18eb10) returned 0x0 [0157.136] IUnknown:AddRef (This=0x100ed50) returned 0x3 [0157.136] IWbemClassObject:Get (in: This=0x100ed50, wszName="__GENUS", lFlags=0, pVal=0x18ee1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee9c*=0, plFlavor=0x18ee98*=0 | out: pVal=0x18ee1c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ee9c*=3, plFlavor=0x18ee98*=64) returned 0x0 [0157.136] IWbemClassObject:Get (in: This=0x100ed50, wszName="__PATH", lFlags=0, pVal=0x18ee00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee84*=0, plFlavor=0x18ee80*=0 | out: pVal=0x18ee00*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x18ee84*=8, plFlavor=0x18ee80*=64) returned 0x0 [0157.137] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0157.137] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0157.137] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x42c [0157.137] SetEvent (hEvent=0x30c) returned 1 [0157.138] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18edd8*=0x42c, lpdwindex=0x18ebf4 | out: lpdwindex=0x18ebf4) returned 0x0 [0157.146] CoGetContextToken (in: pToken=0x18eca8 | out: pToken=0x18eca8) returned 0x0 [0157.146] CoGetContextToken (in: pToken=0x18ec08 | out: pToken=0x18ec08) returned 0x0 [0157.146] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd10, riid=0x18ecd8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ecd4 | out: ppvObject=0x18ecd4*=0xffdd10) returned 0x0 [0157.146] WbemDefPath:IUnknown:AddRef (This=0xffdd10) returned 0x3 [0157.146] WbemDefPath:IUnknown:Release (This=0xffdd10) returned 0x2 [0157.146] WbemDefPath:IWbemPath:SetText (This=0xffdd10, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0157.146] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffd680, puCount=0x18ee58 | out: puCount=0x18ee58*=0x2) returned 0x0 [0157.146] WbemDefPath:IWbemPath:GetText (in: This=0xffd680, lFlags=4, puBuffLength=0x18ee54*=0x0, pszText=0x0 | out: puBuffLength=0x18ee54*=0xf, pszText=0x0) returned 0x0 [0157.146] WbemDefPath:IWbemPath:GetText (in: This=0xffd680, lFlags=4, puBuffLength=0x18ee54*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee54*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.147] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffd680, puCount=0x18ee60 | out: puCount=0x18ee60*=0x2) returned 0x0 [0157.147] WbemDefPath:IWbemPath:GetText (in: This=0xffd680, lFlags=4, puBuffLength=0x18ee5c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee5c*=0xf, pszText=0x0) returned 0x0 [0157.147] WbemDefPath:IWbemPath:GetText (in: This=0xffd680, lFlags=4, puBuffLength=0x18ee5c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee5c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.147] IWbemClassObject:Get (in: This=0x100ed50, wszName="processorID", lFlags=0, pVal=0x18ee5c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27543c8*=0, plFlavor=0x27543cc*=0 | out: pVal=0x18ee5c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF00050654", varVal2=0x0), pType=0x27543c8*=8, plFlavor=0x27543cc*=0) returned 0x0 [0157.147] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0157.147] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0157.147] IWbemClassObject:Get (in: This=0x100ed50, wszName="processorID", lFlags=0, pVal=0x18ee64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27543c8*=8, plFlavor=0x27543cc*=0 | out: pVal=0x18ee64*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF00050654", varVal2=0x0), pType=0x27543c8*=8, plFlavor=0x27543cc*=0) returned 0x0 [0157.147] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0157.147] SysStringByteLen (bstr="0F8BFBFF00050654") returned 0x20 [0157.147] CoTaskMemAlloc (cb=0x4) returned 0x100fc78 [0157.147] IEnumWbemClassObject:Next (in: This=0x1003a58, lTimeout=-1, uCount=0x1, apObjects=0x100fc78, puReturned=0x2753b78 | out: apObjects=0x100fc78*=0x0, puReturned=0x2753b78*=0x0) returned 0x1 [0157.149] CoTaskMemFree (pv=0x100fc78) [0157.149] CoGetContextToken (in: pToken=0x18ed50 | out: pToken=0x18ed50) returned 0x0 [0157.149] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x1 [0157.149] IUnknown:Release (This=0x1003a58) returned 0x0 [0157.195] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x430 [0157.195] SetEvent (hEvent=0x30c) returned 1 [0157.196] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ee24*=0x430, lpdwindex=0x18ec44 | out: lpdwindex=0x18ec44) returned 0x0 [0157.207] CoGetContextToken (in: pToken=0x18ecf0 | out: pToken=0x18ecf0) returned 0x0 [0157.207] CoGetContextToken (in: pToken=0x18ec50 | out: pToken=0x18ec50) returned 0x0 [0157.207] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdae0, riid=0x18ed20*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ed1c | out: ppvObject=0x18ed1c*=0xffdae0) returned 0x0 [0157.207] WbemDefPath:IUnknown:AddRef (This=0xffdae0) returned 0x3 [0157.207] WbemDefPath:IUnknown:Release (This=0xffdae0) returned 0x2 [0157.207] WbemDefPath:IWbemPath:SetText (This=0xffdae0, uMode=0x4, pszPath="Win32_NetworkAdapterConfiguration") returned 0x0 [0157.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdae0, puCount=0x18eea4 | out: puCount=0x18eea4*=0x0) returned 0x0 [0157.207] WbemDefPath:IWbemPath:GetText (in: This=0xffdae0, lFlags=2, puBuffLength=0x18eea0*=0x0, pszText=0x0 | out: puBuffLength=0x18eea0*=0x22, pszText=0x0) returned 0x0 [0157.207] WbemDefPath:IWbemPath:GetText (in: This=0xffdae0, lFlags=2, puBuffLength=0x18eea0*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x18eea0*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0157.207] WbemDefPath:IWbemPath:GetInfo (in: This=0xffdae0, uRequestedInfo=0x0, puResponse=0x18eeac | out: puResponse=0x18eeac*=0xc15) returned 0x0 [0157.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdae0, puCount=0x18eea4 | out: puCount=0x18eea4*=0x0) returned 0x0 [0157.207] WbemDefPath:IWbemPath:GetInfo (in: This=0xffdae0, uRequestedInfo=0x0, puResponse=0x18eeac | out: puResponse=0x18eeac*=0xc15) returned 0x0 [0157.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdae0, puCount=0x18ee94 | out: puCount=0x18ee94*=0x0) returned 0x0 [0157.207] WbemDefPath:IWbemPath:GetText (in: This=0xffdae0, lFlags=2, puBuffLength=0x18ee90*=0x0, pszText=0x0 | out: puBuffLength=0x18ee90*=0x22, pszText=0x0) returned 0x0 [0157.208] WbemDefPath:IWbemPath:GetText (in: This=0xffdae0, lFlags=2, puBuffLength=0x18ee90*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x18ee90*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0157.208] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdae0, puCount=0x18ee94 | out: puCount=0x18ee94*=0x0) returned 0x0 [0157.208] WbemDefPath:IWbemPath:GetText (in: This=0xffdae0, lFlags=2, puBuffLength=0x18ee90*=0x0, pszText=0x0 | out: puBuffLength=0x18ee90*=0x22, pszText=0x0) returned 0x0 [0157.208] WbemDefPath:IWbemPath:GetText (in: This=0xffdae0, lFlags=2, puBuffLength=0x18ee90*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x18ee90*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0157.208] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdae0, puCount=0x18ee24 | out: puCount=0x18ee24*=0x0) returned 0x0 [0157.208] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee10 | out: puCount=0x18ee10*=0x2) returned 0x0 [0157.208] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee0c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee0c*=0xf, pszText=0x0) returned 0x0 [0157.208] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.208] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x43c [0157.208] SetEvent (hEvent=0x30c) returned 1 [0157.208] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed6c*=0x43c, lpdwindex=0x18eb8c | out: lpdwindex=0x18eb8c) returned 0x0 [0157.211] CoGetContextToken (in: pToken=0x18ec38 | out: pToken=0x18ec38) returned 0x0 [0157.211] CoGetContextToken (in: pToken=0x18eb98 | out: pToken=0x18eb98) returned 0x0 [0157.211] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd80, riid=0x18ec68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xffdd80) returned 0x0 [0157.211] WbemDefPath:IUnknown:AddRef (This=0xffdd80) returned 0x3 [0157.211] WbemDefPath:IUnknown:Release (This=0xffdd80) returned 0x2 [0157.211] WbemDefPath:IWbemPath:SetText (This=0xffdd80, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0157.211] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ede8 | out: puCount=0x18ede8*=0x2) returned 0x0 [0157.211] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ede4*=0x0, pszText=0x0 | out: puBuffLength=0x18ede4*=0xf, pszText=0x0) returned 0x0 [0157.211] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.222] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed08*=0x450, lpdwindex=0x18ebbc | out: lpdwindex=0x18ebbc) returned 0x0 [0157.252] CoGetContextToken (in: pToken=0x18eb00 | out: pToken=0x18eb00) returned 0x0 [0157.252] CoGetContextToken (in: pToken=0x18eaa8 | out: pToken=0x18eaa8) returned 0x0 [0157.252] IUnknown:QueryInterface (in: This=0xfb21f0, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea84 | out: ppvObject=0x18ea84*=0xfb2200) returned 0x0 [0157.252] CObjectContext::ContextCallback () returned 0x0 [0157.254] IUnknown:Release (This=0xfb2200) returned 0x1 [0157.254] CoUnmarshalInterface (in: pStm=0xff2800, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eaf4 | out: ppv=0x18eaf4*=0xff8dc0) returned 0x0 [0157.254] CoMarshalInterface (pStm=0xff2800, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff8dc0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0157.254] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e994 | out: ppvObject=0x18e994*=0xff8dc0) returned 0x0 [0157.254] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e950 | out: ppvObject=0x18e950*=0x0) returned 0x80004002 [0157.255] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e76c | out: ppvObject=0x18e76c*=0x0) returned 0x80004002 [0157.255] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e544 | out: ppvObject=0x18e544*=0x0) returned 0x80004002 [0157.256] WbemLocator:IUnknown:AddRef (This=0xff8dc0) returned 0x3 [0157.256] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e2a4 | out: ppvObject=0x18e2a4*=0x0) returned 0x80004002 [0157.256] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e254 | out: ppvObject=0x18e254*=0x0) returned 0x80004002 [0157.256] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e260 | out: ppvObject=0x18e260*=0xff8d1c) returned 0x0 [0157.256] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff8d1c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e268 | out: pCid=0x18e268*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.256] WbemLocator:IUnknown:Release (This=0xff8d1c) returned 0x3 [0157.256] CoGetContextToken (in: pToken=0x18e2c0 | out: pToken=0x18e2c0) returned 0x0 [0157.256] CoGetContextToken (in: pToken=0x18e6c8 | out: pToken=0x18e6c8) returned 0x0 [0157.256] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e754 | out: ppvObject=0x18e754*=0xff8da4) returned 0x0 [0157.256] WbemLocator:IRpcOptions:Query (in: This=0xff8da4, pPrx=0xff8dc0, dwProperty=2, pdwValue=0x18e760 | out: pdwValue=0x18e760) returned 0x0 [0157.256] WbemLocator:IUnknown:Release (This=0xff8da4) returned 0x3 [0157.257] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x2 [0157.257] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x1 [0157.257] CoGetContextToken (in: pToken=0x18ea40 | out: pToken=0x18ea40) returned 0x0 [0157.257] WbemLocator:IUnknown:AddRef (This=0xff8dc0) returned 0x2 [0157.257] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecf8 | out: ppvObject=0x18ecf8*=0xff8d9c) returned 0x0 [0157.257] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff8d9c, pProxy=0xff8dc0, pAuthnSvc=0x18ed48, pAuthzSvc=0x18ed44, pServerPrincName=0x18ed3c, pAuthnLevel=0x18ed40, pImpLevel=0x18ed30, pAuthInfo=0x18ed34, pCapabilites=0x18ed38 | out: pAuthnSvc=0x18ed48*=0xa, pAuthzSvc=0x18ed44*=0x0, pServerPrincName=0x18ed3c, pAuthnLevel=0x18ed40*=0x6, pImpLevel=0x18ed30*=0x2, pAuthInfo=0x18ed34, pCapabilites=0x18ed38*=0x1) returned 0x0 [0157.257] WbemLocator:IUnknown:Release (This=0xff8d9c) returned 0x2 [0157.257] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecec | out: ppvObject=0x18ecec*=0xff8dc0) returned 0x0 [0157.257] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecd8 | out: ppvObject=0x18ecd8*=0xff8d9c) returned 0x0 [0157.257] WbemLocator:IClientSecurity:SetBlanket (This=0xff8d9c, pProxy=0xff8dc0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.257] WbemLocator:IUnknown:Release (This=0xff8d9c) returned 0x3 [0157.257] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x2 [0157.257] CoTaskMemFree (pv=0xff2d78) [0157.258] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x1 [0157.258] SysStringLen (param_1=0x0) returned 0x0 [0157.258] CoGetContextToken (in: pToken=0x18ecb8 | out: pToken=0x18ecb8) returned 0x0 [0157.258] CoGetContextToken (in: pToken=0x18ec18 | out: pToken=0x18ec18) returned 0x0 [0157.258] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x18ece8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18ece4 | out: ppvObject=0x18ece4*=0x1000d48) returned 0x0 [0157.266] WbemLocator:IUnknown:AddRef (This=0x1000d48) returned 0x3 [0157.267] WbemLocator:IUnknown:Release (This=0x1000d48) returned 0x2 [0157.267] CoGetContextToken (in: pToken=0x18ec78 | out: pToken=0x18ec78) returned 0x0 [0157.267] WbemLocator:IUnknown:AddRef (This=0x1000d48) returned 0x3 [0157.267] WbemLocator:IUnknown:QueryInterface (in: This=0x1000d48, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecf8 | out: ppvObject=0x18ecf8*=0xff8d9c) returned 0x0 [0157.267] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff8d9c, pProxy=0x1000d48, pAuthnSvc=0x18ed48, pAuthzSvc=0x18ed44, pServerPrincName=0x18ed3c, pAuthnLevel=0x18ed40, pImpLevel=0x18ed30, pAuthInfo=0x18ed34, pCapabilites=0x18ed38 | out: pAuthnSvc=0x18ed48*=0xa, pAuthzSvc=0x18ed44*=0x0, pServerPrincName=0x18ed3c, pAuthnLevel=0x18ed40*=0x6, pImpLevel=0x18ed30*=0x2, pAuthInfo=0x18ed34, pCapabilites=0x18ed38*=0x1) returned 0x0 [0157.267] WbemLocator:IUnknown:Release (This=0xff8d9c) returned 0x3 [0157.267] WbemLocator:IUnknown:QueryInterface (in: This=0x1000d48, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecec | out: ppvObject=0x18ecec*=0xff8dc0) returned 0x0 [0157.267] WbemLocator:IUnknown:QueryInterface (in: This=0x1000d48, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecd8 | out: ppvObject=0x18ecd8*=0xff8d9c) returned 0x0 [0157.267] WbemLocator:IClientSecurity:SetBlanket (This=0xff8d9c, pProxy=0x1000d48, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.268] WbemLocator:IUnknown:Release (This=0xff8d9c) returned 0x4 [0157.268] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x3 [0157.268] CoTaskMemFree (pv=0xff32b8) [0157.268] WbemLocator:IUnknown:Release (This=0x1000d48) returned 0x2 [0157.268] SysStringLen (param_1=0x0) returned 0x0 [0157.268] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee0c | out: puCount=0x18ee0c*=0x2) returned 0x0 [0157.268] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee08*=0x0, pszText=0x0 | out: puBuffLength=0x18ee08*=0xf, pszText=0x0) returned 0x0 [0157.268] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee08*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee08*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.268] CoGetContextToken (in: pToken=0x18ea78 | out: pToken=0x18ea78) returned 0x0 [0157.268] CoUnmarshalInterface (in: pStm=0xff2800, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ea6c | out: ppv=0x18ea6c*=0xff8dc0) returned 0x0 [0157.268] CoMarshalInterface (pStm=0xff2800, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff8dc0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0157.269] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e90c | out: ppvObject=0x18e90c*=0xff8dc0) returned 0x0 [0157.269] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x3 [0157.269] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x2 [0157.269] CoGetContextToken (in: pToken=0x18e9b8 | out: pToken=0x18e9b8) returned 0x0 [0157.269] WbemLocator:IUnknown:AddRef (This=0xff8dc0) returned 0x3 [0157.269] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec70 | out: ppvObject=0x18ec70*=0xff8d9c) returned 0x0 [0157.269] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff8d9c, pProxy=0xff8dc0, pAuthnSvc=0x18ecc0, pAuthzSvc=0x18ecbc, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8, pImpLevel=0x18eca8, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0 | out: pAuthnSvc=0x18ecc0*=0xa, pAuthzSvc=0x18ecbc*=0x0, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8*=0x6, pImpLevel=0x18eca8*=0x3, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0*=0x20) returned 0x0 [0157.269] WbemLocator:IUnknown:Release (This=0xff8d9c) returned 0x3 [0157.269] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xff8dc0) returned 0x0 [0157.269] WbemLocator:IUnknown:QueryInterface (in: This=0xff8dc0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec50 | out: ppvObject=0x18ec50*=0xff8d9c) returned 0x0 [0157.269] WbemLocator:IClientSecurity:SetBlanket (This=0xff8d9c, pProxy=0xff8dc0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.270] WbemLocator:IUnknown:Release (This=0xff8d9c) returned 0x4 [0157.270] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x3 [0157.270] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x2 [0157.270] SysStringLen (param_1=0x0) returned 0x0 [0157.270] CoGetContextToken (in: pToken=0x18ec30 | out: pToken=0x18ec30) returned 0x0 [0157.270] WbemLocator:IUnknown:AddRef (This=0x1000d48) returned 0x3 [0157.270] WbemLocator:IUnknown:Release (This=0x1000d48) returned 0x2 [0157.270] CoGetContextToken (in: pToken=0x18ebf0 | out: pToken=0x18ebf0) returned 0x0 [0157.270] WbemLocator:IUnknown:AddRef (This=0x1000d48) returned 0x3 [0157.270] WbemLocator:IUnknown:QueryInterface (in: This=0x1000d48, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec70 | out: ppvObject=0x18ec70*=0xff8d9c) returned 0x0 [0157.270] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff8d9c, pProxy=0x1000d48, pAuthnSvc=0x18ecc0, pAuthzSvc=0x18ecbc, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8, pImpLevel=0x18eca8, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0 | out: pAuthnSvc=0x18ecc0*=0xa, pAuthzSvc=0x18ecbc*=0x0, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8*=0x6, pImpLevel=0x18eca8*=0x3, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0*=0x20) returned 0x0 [0157.270] WbemLocator:IUnknown:Release (This=0xff8d9c) returned 0x3 [0157.270] WbemLocator:IUnknown:QueryInterface (in: This=0x1000d48, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xff8dc0) returned 0x0 [0157.270] WbemLocator:IUnknown:QueryInterface (in: This=0x1000d48, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec50 | out: ppvObject=0x18ec50*=0xff8d9c) returned 0x0 [0157.271] WbemLocator:IClientSecurity:SetBlanket (This=0xff8d9c, pProxy=0x1000d48, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.271] WbemLocator:IUnknown:Release (This=0xff8d9c) returned 0x4 [0157.271] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x3 [0157.271] WbemLocator:IUnknown:Release (This=0x1000d48) returned 0x2 [0157.271] SysStringLen (param_1=0x0) returned 0x0 [0157.271] WbemDefPath:IWbemPath:GetText (in: This=0xffdae0, lFlags=2, puBuffLength=0x18ee10*=0x0, pszText=0x0 | out: puBuffLength=0x18ee10*=0x22, pszText=0x0) returned 0x0 [0157.271] WbemDefPath:IWbemPath:GetText (in: This=0xffdae0, lFlags=2, puBuffLength=0x18ee10*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x18ee10*=0x22, pszText="Win32_NetworkAdapterConfiguration") returned 0x0 [0157.271] IWbemServices:GetObject (in: This=0x1000d48, strObjectPath="Win32_NetworkAdapterConfiguration", lFlags=0, pCtx=0x0, ppObject=0x18edc4*=0x0, ppCallResult=0x0 | out: ppObject=0x18edc4*=0x102d760, ppCallResult=0x0) returned 0x0 [0157.304] IWbemClassObject:Get (in: This=0x102d760, wszName="__PATH", lFlags=0, pVal=0x18edac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee54*=0, plFlavor=0x18ee50*=0 | out: pVal=0x18edac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration", varVal2=0x0), pType=0x18ee54*=8, plFlavor=0x18ee50*=64) returned 0x0 [0157.304] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x6a [0157.304] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x6a [0157.304] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x454 [0157.304] SetEvent (hEvent=0x30c) returned 1 [0157.305] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed68*=0x454, lpdwindex=0x18eb84 | out: lpdwindex=0x18eb84) returned 0x0 [0157.307] CoGetContextToken (in: pToken=0x18ec38 | out: pToken=0x18ec38) returned 0x0 [0157.308] CoGetContextToken (in: pToken=0x18eb98 | out: pToken=0x18eb98) returned 0x0 [0157.308] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd990, riid=0x18ec68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xffd990) returned 0x0 [0157.308] WbemDefPath:IUnknown:AddRef (This=0xffd990) returned 0x3 [0157.308] WbemDefPath:IUnknown:Release (This=0xffd990) returned 0x2 [0157.308] WbemDefPath:IWbemPath:SetText (This=0xffd990, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_NetworkAdapterConfiguration") returned 0x0 [0157.308] IWbemClassObject:Get (in: This=0x102d760, wszName="__CLASS", lFlags=0, pVal=0x18ee1c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee9c*=0, plFlavor=0x18ee98*=0 | out: pVal=0x18ee1c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_NetworkAdapterConfiguration", varVal2=0x0), pType=0x18ee9c*=8, plFlavor=0x18ee98*=64) returned 0x0 [0157.308] SysStringByteLen (bstr="Win32_NetworkAdapterConfiguration") returned 0x42 [0157.308] SysStringByteLen (bstr="Win32_NetworkAdapterConfiguration") returned 0x42 [0157.308] CoGetContextToken (in: pToken=0x18ec10 | out: pToken=0x18ec10) returned 0x0 [0157.308] WbemLocator:IUnknown:AddRef (This=0x1000d48) returned 0x3 [0157.308] IWbemServices:CreateInstanceEnum (in: This=0x1000d48, strFilter="Win32_NetworkAdapterConfiguration", lFlags=17, pCtx=0x0, ppEnum=0x18ee18 | out: ppEnum=0x18ee18*=0x1010328) returned 0x0 [0157.311] IUnknown:QueryInterface (in: This=0x1010328, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec80 | out: ppvObject=0x18ec80*=0x101032c) returned 0x0 [0157.311] IClientSecurity:QueryBlanket (in: This=0x101032c, pProxy=0x1010328, pAuthnSvc=0x18ecd0, pAuthzSvc=0x18eccc, pServerPrincName=0x18ecc4, pAuthnLevel=0x18ecc8, pImpLevel=0x18ecb8, pAuthInfo=0x18ecbc, pCapabilites=0x18ecc0 | out: pAuthnSvc=0x18ecd0*=0xa, pAuthzSvc=0x18eccc*=0x0, pServerPrincName=0x18ecc4, pAuthnLevel=0x18ecc8*=0x6, pImpLevel=0x18ecb8*=0x2, pAuthInfo=0x18ecbc, pCapabilites=0x18ecc0*=0x1) returned 0x0 [0157.311] IUnknown:Release (This=0x101032c) returned 0x1 [0157.311] IUnknown:QueryInterface (in: This=0x1010328, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec74 | out: ppvObject=0x18ec74*=0xff8fc0) returned 0x0 [0157.311] IUnknown:QueryInterface (in: This=0x1010328, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec60 | out: ppvObject=0x18ec60*=0x101032c) returned 0x0 [0157.311] IClientSecurity:SetBlanket (This=0x101032c, pProxy=0x1010328, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.318] IUnknown:Release (This=0x101032c) returned 0x2 [0157.318] WbemLocator:IUnknown:Release (This=0xff8fc0) returned 0x1 [0157.318] CoTaskMemFree (pv=0xff33a8) [0157.318] IUnknown:QueryInterface (in: This=0x1010328, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e868 | out: ppvObject=0x18e868*=0xff8fc0) returned 0x0 [0157.318] WbemLocator:IUnknown:QueryInterface (in: This=0xff8fc0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e824 | out: ppvObject=0x18e824*=0x0) returned 0x80004002 [0157.347] WbemLocator:IUnknown:QueryInterface (in: This=0xff8fc0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e644 | out: ppvObject=0x18e644*=0x0) returned 0x80004002 [0157.352] IUnknown:QueryInterface (in: This=0x1010328, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e41c | out: ppvObject=0x18e41c*=0x0) returned 0x80004002 [0157.382] WbemLocator:IUnknown:AddRef (This=0xff8fc0) returned 0x3 [0157.382] WbemLocator:IUnknown:QueryInterface (in: This=0xff8fc0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e17c | out: ppvObject=0x18e17c*=0x0) returned 0x80004002 [0157.382] WbemLocator:IUnknown:QueryInterface (in: This=0xff8fc0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0157.382] WbemLocator:IUnknown:QueryInterface (in: This=0xff8fc0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e138 | out: ppvObject=0x18e138*=0xff8f1c) returned 0x0 [0157.382] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff8f1c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e140 | out: pCid=0x18e140*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.382] WbemLocator:IUnknown:Release (This=0xff8f1c) returned 0x3 [0157.382] CoGetContextToken (in: pToken=0x18e198 | out: pToken=0x18e198) returned 0x0 [0157.382] CoGetContextToken (in: pToken=0x18e5a0 | out: pToken=0x18e5a0) returned 0x0 [0157.382] WbemLocator:IUnknown:QueryInterface (in: This=0xff8fc0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e62c | out: ppvObject=0x18e62c*=0xff8fa4) returned 0x0 [0157.383] WbemLocator:IRpcOptions:Query (in: This=0xff8fa4, pPrx=0xff8fc0, dwProperty=2, pdwValue=0x18e638 | out: pdwValue=0x18e638) returned 0x80004002 [0157.383] WbemLocator:IUnknown:Release (This=0xff8fa4) returned 0x3 [0157.383] WbemLocator:IUnknown:Release (This=0xff8fc0) returned 0x2 [0157.383] CoGetContextToken (in: pToken=0x18eb78 | out: pToken=0x18eb78) returned 0x0 [0157.383] CoGetContextToken (in: pToken=0x18ead8 | out: pToken=0x18ead8) returned 0x0 [0157.383] WbemLocator:IUnknown:QueryInterface (in: This=0xff8fc0, riid=0x18eba8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18eba4 | out: ppvObject=0x18eba4*=0x1010328) returned 0x0 [0157.383] IUnknown:AddRef (This=0x1010328) returned 0x4 [0157.383] IUnknown:Release (This=0x1010328) returned 0x3 [0157.383] IUnknown:Release (This=0x1010328) returned 0x2 [0157.383] WbemLocator:IUnknown:Release (This=0x1000d48) returned 0x2 [0157.383] SysStringLen (param_1=0x0) returned 0x0 [0157.383] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee54 | out: puCount=0x18ee54*=0x2) returned 0x0 [0157.383] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee50*=0x0, pszText=0x0 | out: puBuffLength=0x18ee50*=0xf, pszText=0x0) returned 0x0 [0157.383] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee50*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.383] CoGetContextToken (in: pToken=0x18ec98 | out: pToken=0x18ec98) returned 0x0 [0157.412] IUnknown:AddRef (This=0x1010328) returned 0x3 [0157.412] IEnumWbemClassObject:Clone (in: This=0x1010328, ppEnum=0x18ee54 | out: ppEnum=0x18ee54*=0x1010d50) returned 0x0 [0157.417] IUnknown:QueryInterface (in: This=0x1010d50, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed10 | out: ppvObject=0x18ed10*=0x1010d54) returned 0x0 [0157.417] IClientSecurity:QueryBlanket (in: This=0x1010d54, pProxy=0x1010d50, pAuthnSvc=0x18ed60, pAuthzSvc=0x18ed5c, pServerPrincName=0x18ed54, pAuthnLevel=0x18ed58, pImpLevel=0x18ed48, pAuthInfo=0x18ed4c, pCapabilites=0x18ed50 | out: pAuthnSvc=0x18ed60*=0xa, pAuthzSvc=0x18ed5c*=0x0, pServerPrincName=0x18ed54, pAuthnLevel=0x18ed58*=0x6, pImpLevel=0x18ed48*=0x2, pAuthInfo=0x18ed4c, pCapabilites=0x18ed50*=0x1) returned 0x0 [0157.417] IUnknown:Release (This=0x1010d54) returned 0x1 [0157.417] IUnknown:QueryInterface (in: This=0x1010d50, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed04 | out: ppvObject=0x18ed04*=0xff9cc0) returned 0x0 [0157.417] IUnknown:QueryInterface (in: This=0x1010d50, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecf0 | out: ppvObject=0x18ecf0*=0x1010d54) returned 0x0 [0157.418] IClientSecurity:SetBlanket (This=0x1010d54, pProxy=0x1010d50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.427] IUnknown:Release (This=0x1010d54) returned 0x2 [0157.427] WbemLocator:IUnknown:Release (This=0xff9cc0) returned 0x1 [0157.427] CoTaskMemFree (pv=0xff3228) [0157.427] IUnknown:QueryInterface (in: This=0x1010d50, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8ec | out: ppvObject=0x18e8ec*=0xff9cc0) returned 0x0 [0157.427] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e8a8 | out: ppvObject=0x18e8a8*=0x0) returned 0x80004002 [0157.429] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e6c4 | out: ppvObject=0x18e6c4*=0x0) returned 0x80004002 [0157.439] IUnknown:QueryInterface (in: This=0x1010d50, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e49c | out: ppvObject=0x18e49c*=0x0) returned 0x80004002 [0157.450] WbemLocator:IUnknown:AddRef (This=0xff9cc0) returned 0x3 [0157.451] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e1fc | out: ppvObject=0x18e1fc*=0x0) returned 0x80004002 [0157.452] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e1ac | out: ppvObject=0x18e1ac*=0x0) returned 0x80004002 [0157.452] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1b8 | out: ppvObject=0x18e1b8*=0xff9c1c) returned 0x0 [0157.490] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff9c1c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e1c0 | out: pCid=0x18e1c0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.490] WbemLocator:IUnknown:Release (This=0xff9c1c) returned 0x3 [0157.490] CoGetContextToken (in: pToken=0x18e218 | out: pToken=0x18e218) returned 0x0 [0157.525] CoGetContextToken (in: pToken=0x18e620 | out: pToken=0x18e620) returned 0x0 [0157.525] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6ac | out: ppvObject=0x18e6ac*=0xff9ca4) returned 0x0 [0157.525] WbemLocator:IRpcOptions:Query (in: This=0xff9ca4, pPrx=0xff9cc0, dwProperty=2, pdwValue=0x18e6b8 | out: pdwValue=0x18e6b8) returned 0x80004002 [0157.525] WbemLocator:IUnknown:Release (This=0xff9ca4) returned 0x3 [0157.525] WbemLocator:IUnknown:Release (This=0xff9cc0) returned 0x2 [0157.525] CoGetContextToken (in: pToken=0x18ec00 | out: pToken=0x18ec00) returned 0x0 [0157.525] CoGetContextToken (in: pToken=0x18eb60 | out: pToken=0x18eb60) returned 0x0 [0157.525] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x18ec30*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18ec2c | out: ppvObject=0x18ec2c*=0x1010d50) returned 0x0 [0157.525] IUnknown:AddRef (This=0x1010d50) returned 0x4 [0157.525] IUnknown:Release (This=0x1010d50) returned 0x3 [0157.525] IUnknown:Release (This=0x1010d50) returned 0x2 [0157.525] IUnknown:Release (This=0x1010328) returned 0x2 [0157.525] SysStringLen (param_1=0x0) returned 0x0 [0157.525] IEnumWbemClassObject:Reset (This=0x1010d50) returned 0x0 [0157.561] CoTaskMemAlloc (cb=0x4) returned 0x100fd88 [0157.561] IEnumWbemClassObject:Next (in: This=0x1010d50, lTimeout=-1, uCount=0x1, apObjects=0x100fd88, puReturned=0x275607c | out: apObjects=0x100fd88*=0x102dc80, puReturned=0x275607c*=0x1) returned 0x0 [0157.642] IUnknown:QueryInterface (in: This=0x102dc80, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e4b0 | out: ppvObject=0x18e4b0*=0x102dc80) returned 0x0 [0157.642] IUnknown:QueryInterface (in: This=0x102dc80, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e46c | out: ppvObject=0x18e46c*=0x0) returned 0x80004002 [0157.642] IUnknown:QueryInterface (in: This=0x102dc80, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e28c | out: ppvObject=0x18e28c*=0x0) returned 0x80004002 [0157.642] IUnknown:QueryInterface (in: This=0x102dc80, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e064 | out: ppvObject=0x18e064*=0x0) returned 0x80004002 [0157.643] IUnknown:AddRef (This=0x102dc80) returned 0x3 [0157.643] IUnknown:QueryInterface (in: This=0x102dc80, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18ddc4 | out: ppvObject=0x18ddc4*=0x0) returned 0x80004002 [0157.643] IUnknown:QueryInterface (in: This=0x102dc80, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd74 | out: ppvObject=0x18dd74*=0x0) returned 0x80004002 [0157.643] IUnknown:QueryInterface (in: This=0x102dc80, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dd80 | out: ppvObject=0x18dd80*=0x102dc84) returned 0x0 [0157.643] IMarshal:GetUnmarshalClass (in: This=0x102dc84, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd88 | out: pCid=0x18dd88*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.643] IUnknown:Release (This=0x102dc84) returned 0x3 [0157.643] CoGetContextToken (in: pToken=0x18dde0 | out: pToken=0x18dde0) returned 0x0 [0157.643] CoGetContextToken (in: pToken=0x18e1e8 | out: pToken=0x18e1e8) returned 0x0 [0157.643] IUnknown:QueryInterface (in: This=0x102dc80, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e274 | out: ppvObject=0x18e274*=0x0) returned 0x80004002 [0157.643] IUnknown:Release (This=0x102dc80) returned 0x2 [0157.643] CoGetContextToken (in: pToken=0x18e7c0 | out: pToken=0x18e7c0) returned 0x0 [0157.643] CoGetContextToken (in: pToken=0x18e720 | out: pToken=0x18e720) returned 0x0 [0157.643] IUnknown:QueryInterface (in: This=0x102dc80, riid=0x18e7f0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e7ec | out: ppvObject=0x18e7ec*=0x102dc80) returned 0x0 [0157.643] IUnknown:AddRef (This=0x102dc80) returned 0x4 [0157.644] IUnknown:Release (This=0x102dc80) returned 0x3 [0157.644] IUnknown:Release (This=0x102dc80) returned 0x2 [0157.644] CoTaskMemFree (pv=0x100fd88) [0157.644] CoGetContextToken (in: pToken=0x18eb30 | out: pToken=0x18eb30) returned 0x0 [0157.644] IUnknown:AddRef (This=0x102dc80) returned 0x3 [0157.644] IWbemClassObject:Get (in: This=0x102dc80, wszName="__GENUS", lFlags=0, pVal=0x18ee44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eec4*=0, plFlavor=0x18eec0*=0 | out: pVal=0x18ee44*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eec4*=3, plFlavor=0x18eec0*=64) returned 0x0 [0157.644] IWbemClassObject:Get (in: This=0x102dc80, wszName="__PATH", lFlags=0, pVal=0x18ee28*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eeac*=0, plFlavor=0x18eea8*=0 | out: pVal=0x18ee28*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0", varVal2=0x0), pType=0x18eeac*=8, plFlavor=0x18eea8*=64) returned 0x0 [0157.644] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x7a [0157.644] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x7a [0157.644] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x458 [0157.644] SetEvent (hEvent=0x30c) returned 1 [0157.645] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ee00*=0x458, lpdwindex=0x18ec1c | out: lpdwindex=0x18ec1c) returned 0x0 [0157.647] CoGetContextToken (in: pToken=0x18ecd0 | out: pToken=0x18ecd0) returned 0x0 [0157.648] CoGetContextToken (in: pToken=0x18ec30 | out: pToken=0x18ec30) returned 0x0 [0157.648] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd7d0, riid=0x18ed00*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ecfc | out: ppvObject=0x18ecfc*=0xffd7d0) returned 0x0 [0157.648] WbemDefPath:IUnknown:AddRef (This=0xffd7d0) returned 0x3 [0157.648] WbemDefPath:IUnknown:Release (This=0xffd7d0) returned 0x2 [0157.648] WbemDefPath:IWbemPath:SetText (This=0xffd7d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=0") returned 0x0 [0157.648] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee80 | out: puCount=0x18ee80*=0x2) returned 0x0 [0157.648] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee7c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee7c*=0xf, pszText=0x0) returned 0x0 [0157.648] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.648] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee4c | out: puCount=0x18ee4c*=0x2) returned 0x0 [0157.648] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee48*=0x0, pszText=0x0 | out: puBuffLength=0x18ee48*=0xf, pszText=0x0) returned 0x0 [0157.648] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee48*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee48*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.648] IWbemClassObject:Get (in: This=0x102dc80, wszName="IPEnabled", lFlags=0, pVal=0x18ee48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27568e0*=0, plFlavor=0x27568e4*=0 | out: pVal=0x18ee48*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27568e0*=11, plFlavor=0x27568e4*=0) returned 0x0 [0157.649] IWbemClassObject:Get (in: This=0x102dc80, wszName="IPEnabled", lFlags=0, pVal=0x18ee50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27568e0*=11, plFlavor=0x27568e4*=0 | out: pVal=0x18ee50*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27568e0*=11, plFlavor=0x27568e4*=0) returned 0x0 [0157.654] IUnknown:Release (This=0x102dc80) returned 0x2 [0157.654] CoTaskMemAlloc (cb=0x4) returned 0x100fce8 [0157.655] IEnumWbemClassObject:Next (in: This=0x1010d50, lTimeout=-1, uCount=0x1, apObjects=0x100fce8, puReturned=0x275607c | out: apObjects=0x100fce8*=0x1033c98, puReturned=0x275607c*=0x1) returned 0x0 [0157.658] IUnknown:QueryInterface (in: This=0x1033c98, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e4b0 | out: ppvObject=0x18e4b0*=0x1033c98) returned 0x0 [0157.658] IUnknown:QueryInterface (in: This=0x1033c98, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e46c | out: ppvObject=0x18e46c*=0x0) returned 0x80004002 [0157.658] IUnknown:QueryInterface (in: This=0x1033c98, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e28c | out: ppvObject=0x18e28c*=0x0) returned 0x80004002 [0157.658] IUnknown:QueryInterface (in: This=0x1033c98, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e064 | out: ppvObject=0x18e064*=0x0) returned 0x80004002 [0157.658] IUnknown:AddRef (This=0x1033c98) returned 0x3 [0157.658] IUnknown:QueryInterface (in: This=0x1033c98, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18ddc4 | out: ppvObject=0x18ddc4*=0x0) returned 0x80004002 [0157.658] IUnknown:QueryInterface (in: This=0x1033c98, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd74 | out: ppvObject=0x18dd74*=0x0) returned 0x80004002 [0157.658] IUnknown:QueryInterface (in: This=0x1033c98, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dd80 | out: ppvObject=0x18dd80*=0x1033c9c) returned 0x0 [0157.658] IMarshal:GetUnmarshalClass (in: This=0x1033c9c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd88 | out: pCid=0x18dd88*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.658] IUnknown:Release (This=0x1033c9c) returned 0x3 [0157.659] CoGetContextToken (in: pToken=0x18dde0 | out: pToken=0x18dde0) returned 0x0 [0157.659] CoGetContextToken (in: pToken=0x18e1e8 | out: pToken=0x18e1e8) returned 0x0 [0157.659] IUnknown:QueryInterface (in: This=0x1033c98, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e274 | out: ppvObject=0x18e274*=0x0) returned 0x80004002 [0157.659] IUnknown:Release (This=0x1033c98) returned 0x2 [0157.659] CoGetContextToken (in: pToken=0x18e7c0 | out: pToken=0x18e7c0) returned 0x0 [0157.659] CoGetContextToken (in: pToken=0x18e720 | out: pToken=0x18e720) returned 0x0 [0157.659] IUnknown:QueryInterface (in: This=0x1033c98, riid=0x18e7f0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e7ec | out: ppvObject=0x18e7ec*=0x1033c98) returned 0x0 [0157.659] IUnknown:AddRef (This=0x1033c98) returned 0x4 [0157.659] IUnknown:Release (This=0x1033c98) returned 0x3 [0157.659] IUnknown:Release (This=0x1033c98) returned 0x2 [0157.659] CoTaskMemFree (pv=0x100fce8) [0157.659] CoGetContextToken (in: pToken=0x18eb30 | out: pToken=0x18eb30) returned 0x0 [0157.659] IUnknown:AddRef (This=0x1033c98) returned 0x3 [0157.659] IWbemClassObject:Get (in: This=0x1033c98, wszName="__GENUS", lFlags=0, pVal=0x18ee44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eec4*=0, plFlavor=0x18eec0*=0 | out: pVal=0x18ee44*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eec4*=3, plFlavor=0x18eec0*=64) returned 0x0 [0157.660] IWbemClassObject:Get (in: This=0x1033c98, wszName="__PATH", lFlags=0, pVal=0x18ee28*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eeac*=0, plFlavor=0x18eea8*=0 | out: pVal=0x18ee28*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1", varVal2=0x0), pType=0x18eeac*=8, plFlavor=0x18eea8*=64) returned 0x0 [0157.660] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x7a [0157.660] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x7a [0157.660] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x45c [0157.660] SetEvent (hEvent=0x30c) returned 1 [0157.660] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ee00*=0x45c, lpdwindex=0x18ec1c | out: lpdwindex=0x18ec1c) returned 0x0 [0157.664] CoGetContextToken (in: pToken=0x18ecd0 | out: pToken=0x18ecd0) returned 0x0 [0157.664] CoGetContextToken (in: pToken=0x18ec30 | out: pToken=0x18ec30) returned 0x0 [0157.664] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda70, riid=0x18ed00*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ecfc | out: ppvObject=0x18ecfc*=0xffda70) returned 0x0 [0157.664] WbemDefPath:IUnknown:AddRef (This=0xffda70) returned 0x3 [0157.664] WbemDefPath:IUnknown:Release (This=0xffda70) returned 0x2 [0157.664] WbemDefPath:IWbemPath:SetText (This=0xffda70, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=1") returned 0x0 [0157.665] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee80 | out: puCount=0x18ee80*=0x2) returned 0x0 [0157.665] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee7c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee7c*=0xf, pszText=0x0) returned 0x0 [0157.665] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.665] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee4c | out: puCount=0x18ee4c*=0x2) returned 0x0 [0157.665] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee48*=0x0, pszText=0x0 | out: puBuffLength=0x18ee48*=0xf, pszText=0x0) returned 0x0 [0157.665] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee48*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee48*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.666] IWbemClassObject:Get (in: This=0x1033c98, wszName="IPEnabled", lFlags=0, pVal=0x18ee48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x275738c*=0, plFlavor=0x2757390*=0 | out: pVal=0x18ee48*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x275738c*=11, plFlavor=0x2757390*=0) returned 0x0 [0157.666] IWbemClassObject:Get (in: This=0x1033c98, wszName="IPEnabled", lFlags=0, pVal=0x18ee50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x275738c*=11, plFlavor=0x2757390*=0 | out: pVal=0x18ee50*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x275738c*=11, plFlavor=0x2757390*=0) returned 0x0 [0157.666] IUnknown:Release (This=0x1033c98) returned 0x2 [0157.666] CoTaskMemAlloc (cb=0x4) returned 0x100fe28 [0157.666] IEnumWbemClassObject:Next (in: This=0x1010d50, lTimeout=-1, uCount=0x1, apObjects=0x100fe28, puReturned=0x275607c | out: apObjects=0x100fe28*=0x1033e30, puReturned=0x275607c*=0x1) returned 0x0 [0157.668] IUnknown:QueryInterface (in: This=0x1033e30, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e4b0 | out: ppvObject=0x18e4b0*=0x1033e30) returned 0x0 [0157.668] IUnknown:QueryInterface (in: This=0x1033e30, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e46c | out: ppvObject=0x18e46c*=0x0) returned 0x80004002 [0157.668] IUnknown:QueryInterface (in: This=0x1033e30, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e28c | out: ppvObject=0x18e28c*=0x0) returned 0x80004002 [0157.668] IUnknown:QueryInterface (in: This=0x1033e30, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e064 | out: ppvObject=0x18e064*=0x0) returned 0x80004002 [0157.668] IUnknown:AddRef (This=0x1033e30) returned 0x3 [0157.668] IUnknown:QueryInterface (in: This=0x1033e30, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18ddc4 | out: ppvObject=0x18ddc4*=0x0) returned 0x80004002 [0157.668] IUnknown:QueryInterface (in: This=0x1033e30, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd74 | out: ppvObject=0x18dd74*=0x0) returned 0x80004002 [0157.668] IUnknown:QueryInterface (in: This=0x1033e30, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dd80 | out: ppvObject=0x18dd80*=0x1033e34) returned 0x0 [0157.668] IMarshal:GetUnmarshalClass (in: This=0x1033e34, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd88 | out: pCid=0x18dd88*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.668] IUnknown:Release (This=0x1033e34) returned 0x3 [0157.668] CoGetContextToken (in: pToken=0x18dde0 | out: pToken=0x18dde0) returned 0x0 [0157.669] CoGetContextToken (in: pToken=0x18e1e8 | out: pToken=0x18e1e8) returned 0x0 [0157.669] IUnknown:QueryInterface (in: This=0x1033e30, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e274 | out: ppvObject=0x18e274*=0x0) returned 0x80004002 [0157.669] IUnknown:Release (This=0x1033e30) returned 0x2 [0157.669] CoGetContextToken (in: pToken=0x18e7c0 | out: pToken=0x18e7c0) returned 0x0 [0157.669] CoGetContextToken (in: pToken=0x18e720 | out: pToken=0x18e720) returned 0x0 [0157.669] IUnknown:QueryInterface (in: This=0x1033e30, riid=0x18e7f0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e7ec | out: ppvObject=0x18e7ec*=0x1033e30) returned 0x0 [0157.669] IUnknown:AddRef (This=0x1033e30) returned 0x4 [0157.669] IUnknown:Release (This=0x1033e30) returned 0x3 [0157.669] IUnknown:Release (This=0x1033e30) returned 0x2 [0157.669] CoTaskMemFree (pv=0x100fe28) [0157.669] CoGetContextToken (in: pToken=0x18eb30 | out: pToken=0x18eb30) returned 0x0 [0157.669] IUnknown:AddRef (This=0x1033e30) returned 0x3 [0157.669] IWbemClassObject:Get (in: This=0x1033e30, wszName="__GENUS", lFlags=0, pVal=0x18ee44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eec4*=0, plFlavor=0x18eec0*=0 | out: pVal=0x18ee44*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eec4*=3, plFlavor=0x18eec0*=64) returned 0x0 [0157.669] IWbemClassObject:Get (in: This=0x1033e30, wszName="__PATH", lFlags=0, pVal=0x18ee28*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eeac*=0, plFlavor=0x18eea8*=0 | out: pVal=0x18ee28*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2", varVal2=0x0), pType=0x18eeac*=8, plFlavor=0x18eea8*=64) returned 0x0 [0157.669] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x7a [0157.669] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x7a [0157.670] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x460 [0157.670] SetEvent (hEvent=0x30c) returned 1 [0157.670] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ee00*=0x460, lpdwindex=0x18ec1c | out: lpdwindex=0x18ec1c) returned 0x0 [0157.672] CoGetContextToken (in: pToken=0x18ecd0 | out: pToken=0x18ecd0) returned 0x0 [0157.672] CoGetContextToken (in: pToken=0x18ec30 | out: pToken=0x18ec30) returned 0x0 [0157.673] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda00, riid=0x18ed00*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ecfc | out: ppvObject=0x18ecfc*=0xffda00) returned 0x0 [0157.673] WbemDefPath:IUnknown:AddRef (This=0xffda00) returned 0x3 [0157.673] WbemDefPath:IUnknown:Release (This=0xffda00) returned 0x2 [0157.673] WbemDefPath:IWbemPath:SetText (This=0xffda00, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=2") returned 0x0 [0157.673] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee80 | out: puCount=0x18ee80*=0x2) returned 0x0 [0157.673] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee7c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee7c*=0xf, pszText=0x0) returned 0x0 [0157.673] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.673] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee4c | out: puCount=0x18ee4c*=0x2) returned 0x0 [0157.673] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee48*=0x0, pszText=0x0 | out: puBuffLength=0x18ee48*=0xf, pszText=0x0) returned 0x0 [0157.673] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee48*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee48*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.673] IWbemClassObject:Get (in: This=0x1033e30, wszName="IPEnabled", lFlags=0, pVal=0x18ee48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2757c00*=0, plFlavor=0x2757c04*=0 | out: pVal=0x18ee48*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2757c00*=11, plFlavor=0x2757c04*=0) returned 0x0 [0157.673] IWbemClassObject:Get (in: This=0x1033e30, wszName="IPEnabled", lFlags=0, pVal=0x18ee50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2757c00*=11, plFlavor=0x2757c04*=0 | out: pVal=0x18ee50*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2757c00*=11, plFlavor=0x2757c04*=0) returned 0x0 [0157.673] IUnknown:Release (This=0x1033e30) returned 0x2 [0157.673] CoTaskMemAlloc (cb=0x4) returned 0x100fd98 [0157.674] IEnumWbemClassObject:Next (in: This=0x1010d50, lTimeout=-1, uCount=0x1, apObjects=0x100fd98, puReturned=0x275607c | out: apObjects=0x100fd98*=0x102ec70, puReturned=0x275607c*=0x1) returned 0x0 [0157.675] IUnknown:QueryInterface (in: This=0x102ec70, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e4b0 | out: ppvObject=0x18e4b0*=0x102ec70) returned 0x0 [0157.675] IUnknown:QueryInterface (in: This=0x102ec70, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e46c | out: ppvObject=0x18e46c*=0x0) returned 0x80004002 [0157.675] IUnknown:QueryInterface (in: This=0x102ec70, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e28c | out: ppvObject=0x18e28c*=0x0) returned 0x80004002 [0157.675] IUnknown:QueryInterface (in: This=0x102ec70, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e064 | out: ppvObject=0x18e064*=0x0) returned 0x80004002 [0157.675] IUnknown:AddRef (This=0x102ec70) returned 0x3 [0157.675] IUnknown:QueryInterface (in: This=0x102ec70, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18ddc4 | out: ppvObject=0x18ddc4*=0x0) returned 0x80004002 [0157.675] IUnknown:QueryInterface (in: This=0x102ec70, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd74 | out: ppvObject=0x18dd74*=0x0) returned 0x80004002 [0157.675] IUnknown:QueryInterface (in: This=0x102ec70, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dd80 | out: ppvObject=0x18dd80*=0x102ec74) returned 0x0 [0157.675] IMarshal:GetUnmarshalClass (in: This=0x102ec74, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd88 | out: pCid=0x18dd88*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.675] IUnknown:Release (This=0x102ec74) returned 0x3 [0157.675] CoGetContextToken (in: pToken=0x18dde0 | out: pToken=0x18dde0) returned 0x0 [0157.676] CoGetContextToken (in: pToken=0x18e1e8 | out: pToken=0x18e1e8) returned 0x0 [0157.676] IUnknown:QueryInterface (in: This=0x102ec70, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e274 | out: ppvObject=0x18e274*=0x0) returned 0x80004002 [0157.676] IUnknown:Release (This=0x102ec70) returned 0x2 [0157.676] CoGetContextToken (in: pToken=0x18e7c0 | out: pToken=0x18e7c0) returned 0x0 [0157.676] CoGetContextToken (in: pToken=0x18e720 | out: pToken=0x18e720) returned 0x0 [0157.676] IUnknown:QueryInterface (in: This=0x102ec70, riid=0x18e7f0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e7ec | out: ppvObject=0x18e7ec*=0x102ec70) returned 0x0 [0157.676] IUnknown:AddRef (This=0x102ec70) returned 0x4 [0157.676] IUnknown:Release (This=0x102ec70) returned 0x3 [0157.676] IUnknown:Release (This=0x102ec70) returned 0x2 [0157.676] CoTaskMemFree (pv=0x100fd98) [0157.676] CoGetContextToken (in: pToken=0x18eb30 | out: pToken=0x18eb30) returned 0x0 [0157.676] IUnknown:AddRef (This=0x102ec70) returned 0x3 [0157.676] IWbemClassObject:Get (in: This=0x102ec70, wszName="__GENUS", lFlags=0, pVal=0x18ee44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eec4*=0, plFlavor=0x18eec0*=0 | out: pVal=0x18ee44*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eec4*=3, plFlavor=0x18eec0*=64) returned 0x0 [0157.676] IWbemClassObject:Get (in: This=0x102ec70, wszName="__PATH", lFlags=0, pVal=0x18ee28*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eeac*=0, plFlavor=0x18eea8*=0 | out: pVal=0x18ee28*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3", varVal2=0x0), pType=0x18eeac*=8, plFlavor=0x18eea8*=64) returned 0x0 [0157.676] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x7a [0157.677] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x7a [0157.677] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x464 [0157.677] SetEvent (hEvent=0x30c) returned 1 [0157.677] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ee00*=0x464, lpdwindex=0x18ec1c | out: lpdwindex=0x18ec1c) returned 0x0 [0157.680] CoGetContextToken (in: pToken=0x18ecd0 | out: pToken=0x18ecd0) returned 0x0 [0157.680] CoGetContextToken (in: pToken=0x18ec30 | out: pToken=0x18ec30) returned 0x0 [0157.680] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdb50, riid=0x18ed00*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ecfc | out: ppvObject=0x18ecfc*=0xffdb50) returned 0x0 [0157.680] WbemDefPath:IUnknown:AddRef (This=0xffdb50) returned 0x3 [0157.680] WbemDefPath:IUnknown:Release (This=0xffdb50) returned 0x2 [0157.680] WbemDefPath:IWbemPath:SetText (This=0xffdb50, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=3") returned 0x0 [0157.680] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee80 | out: puCount=0x18ee80*=0x2) returned 0x0 [0157.680] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee7c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee7c*=0xf, pszText=0x0) returned 0x0 [0157.680] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.680] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee4c | out: puCount=0x18ee4c*=0x2) returned 0x0 [0157.680] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee48*=0x0, pszText=0x0 | out: puBuffLength=0x18ee48*=0xf, pszText=0x0) returned 0x0 [0157.681] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee48*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee48*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.681] IWbemClassObject:Get (in: This=0x102ec70, wszName="IPEnabled", lFlags=0, pVal=0x18ee48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2758474*=0, plFlavor=0x2758478*=0 | out: pVal=0x18ee48*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2758474*=11, plFlavor=0x2758478*=0) returned 0x0 [0157.681] IWbemClassObject:Get (in: This=0x102ec70, wszName="IPEnabled", lFlags=0, pVal=0x18ee50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2758474*=11, plFlavor=0x2758478*=0 | out: pVal=0x18ee50*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2758474*=11, plFlavor=0x2758478*=0) returned 0x0 [0157.681] IUnknown:Release (This=0x102ec70) returned 0x2 [0157.681] CoTaskMemAlloc (cb=0x4) returned 0x100fdf8 [0157.681] IEnumWbemClassObject:Next (in: This=0x1010d50, lTimeout=-1, uCount=0x1, apObjects=0x100fdf8, puReturned=0x275607c | out: apObjects=0x100fdf8*=0x10339d0, puReturned=0x275607c*=0x1) returned 0x0 [0157.682] IUnknown:QueryInterface (in: This=0x10339d0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e4b0 | out: ppvObject=0x18e4b0*=0x10339d0) returned 0x0 [0157.683] IUnknown:QueryInterface (in: This=0x10339d0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e46c | out: ppvObject=0x18e46c*=0x0) returned 0x80004002 [0157.683] IUnknown:QueryInterface (in: This=0x10339d0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e28c | out: ppvObject=0x18e28c*=0x0) returned 0x80004002 [0157.683] IUnknown:QueryInterface (in: This=0x10339d0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e064 | out: ppvObject=0x18e064*=0x0) returned 0x80004002 [0157.683] IUnknown:AddRef (This=0x10339d0) returned 0x3 [0157.683] IUnknown:QueryInterface (in: This=0x10339d0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18ddc4 | out: ppvObject=0x18ddc4*=0x0) returned 0x80004002 [0157.683] IUnknown:QueryInterface (in: This=0x10339d0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd74 | out: ppvObject=0x18dd74*=0x0) returned 0x80004002 [0157.683] IUnknown:QueryInterface (in: This=0x10339d0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dd80 | out: ppvObject=0x18dd80*=0x10339d4) returned 0x0 [0157.683] IMarshal:GetUnmarshalClass (in: This=0x10339d4, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd88 | out: pCid=0x18dd88*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.683] IUnknown:Release (This=0x10339d4) returned 0x3 [0157.683] CoGetContextToken (in: pToken=0x18dde0 | out: pToken=0x18dde0) returned 0x0 [0157.683] CoGetContextToken (in: pToken=0x18e1e8 | out: pToken=0x18e1e8) returned 0x0 [0157.683] IUnknown:QueryInterface (in: This=0x10339d0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e274 | out: ppvObject=0x18e274*=0x0) returned 0x80004002 [0157.684] IUnknown:Release (This=0x10339d0) returned 0x2 [0157.684] CoGetContextToken (in: pToken=0x18e7c0 | out: pToken=0x18e7c0) returned 0x0 [0157.684] CoGetContextToken (in: pToken=0x18e720 | out: pToken=0x18e720) returned 0x0 [0157.684] IUnknown:QueryInterface (in: This=0x10339d0, riid=0x18e7f0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e7ec | out: ppvObject=0x18e7ec*=0x10339d0) returned 0x0 [0157.684] IUnknown:AddRef (This=0x10339d0) returned 0x4 [0157.684] IUnknown:Release (This=0x10339d0) returned 0x3 [0157.684] IUnknown:Release (This=0x10339d0) returned 0x2 [0157.684] CoTaskMemFree (pv=0x100fdf8) [0157.684] CoGetContextToken (in: pToken=0x18eb30 | out: pToken=0x18eb30) returned 0x0 [0157.684] IUnknown:AddRef (This=0x10339d0) returned 0x3 [0157.684] IWbemClassObject:Get (in: This=0x10339d0, wszName="__GENUS", lFlags=0, pVal=0x18ee44*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eec4*=0, plFlavor=0x18eec0*=0 | out: pVal=0x18ee44*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eec4*=3, plFlavor=0x18eec0*=64) returned 0x0 [0157.684] IWbemClassObject:Get (in: This=0x10339d0, wszName="__PATH", lFlags=0, pVal=0x18ee28*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eeac*=0, plFlavor=0x18eea8*=0 | out: pVal=0x18ee28*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4", varVal2=0x0), pType=0x18eeac*=8, plFlavor=0x18eea8*=64) returned 0x0 [0157.684] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x7a [0157.684] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x7a [0157.684] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x468 [0157.685] SetEvent (hEvent=0x30c) returned 1 [0157.685] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ee00*=0x468, lpdwindex=0x18ec1c | out: lpdwindex=0x18ec1c) returned 0x0 [0157.688] CoGetContextToken (in: pToken=0x18ecd0 | out: pToken=0x18ecd0) returned 0x0 [0157.688] CoGetContextToken (in: pToken=0x18ec30 | out: pToken=0x18ec30) returned 0x0 [0157.689] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd760, riid=0x18ed00*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ecfc | out: ppvObject=0x18ecfc*=0xffd760) returned 0x0 [0157.689] WbemDefPath:IUnknown:AddRef (This=0xffd760) returned 0x3 [0157.689] WbemDefPath:IUnknown:Release (This=0xffd760) returned 0x2 [0157.689] WbemDefPath:IWbemPath:SetText (This=0xffd760, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=4") returned 0x0 [0157.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee80 | out: puCount=0x18ee80*=0x2) returned 0x0 [0157.689] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee7c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee7c*=0xf, pszText=0x0) returned 0x0 [0157.689] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee4c | out: puCount=0x18ee4c*=0x2) returned 0x0 [0157.689] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee48*=0x0, pszText=0x0 | out: puBuffLength=0x18ee48*=0xf, pszText=0x0) returned 0x0 [0157.689] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee48*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee48*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.689] IWbemClassObject:Get (in: This=0x10339d0, wszName="IPEnabled", lFlags=0, pVal=0x18ee48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2758ce8*=0, plFlavor=0x2758cec*=0 | out: pVal=0x18ee48*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), pType=0x2758ce8*=11, plFlavor=0x2758cec*=0) returned 0x0 [0157.689] IWbemClassObject:Get (in: This=0x10339d0, wszName="IPEnabled", lFlags=0, pVal=0x18ee50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2758ce8*=11, plFlavor=0x2758cec*=0 | out: pVal=0x18ee50*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), pType=0x2758ce8*=11, plFlavor=0x2758cec*=0) returned 0x0 [0157.689] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x18ee4c | out: puCount=0x18ee4c*=0x2) returned 0x0 [0157.689] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee48*=0x0, pszText=0x0 | out: puBuffLength=0x18ee48*=0xf, pszText=0x0) returned 0x0 [0157.689] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=4, puBuffLength=0x18ee48*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee48*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.690] IWbemClassObject:Get (in: This=0x10339d0, wszName="MacAddress", lFlags=0, pVal=0x18ee48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2758d60*=0, plFlavor=0x2758d64*=0 | out: pVal=0x18ee48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="A0:BF:50:E2:37:DC", varVal2=0x0), pType=0x2758d60*=8, plFlavor=0x2758d64*=0) returned 0x0 [0157.690] SysStringByteLen (bstr="A0:BF:50:E2:37:DC") returned 0x22 [0157.690] SysStringByteLen (bstr="A0:BF:50:E2:37:DC") returned 0x22 [0157.690] IWbemClassObject:Get (in: This=0x10339d0, wszName="MacAddress", lFlags=0, pVal=0x18ee50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2758d60*=8, plFlavor=0x2758d64*=0 | out: pVal=0x18ee50*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="A0:BF:50:E2:37:DC", varVal2=0x0), pType=0x2758d60*=8, plFlavor=0x2758d64*=0) returned 0x0 [0157.690] SysStringByteLen (bstr="A0:BF:50:E2:37:DC") returned 0x22 [0157.690] SysStringByteLen (bstr="A0:BF:50:E2:37:DC") returned 0x22 [0157.690] IUnknown:Release (This=0x10339d0) returned 0x2 [0157.690] CoTaskMemAlloc (cb=0x4) returned 0x100fd08 [0157.690] IEnumWbemClassObject:Next (in: This=0x1010d50, lTimeout=-1, uCount=0x1, apObjects=0x100fd08, puReturned=0x275607c | out: apObjects=0x100fd08*=0x0, puReturned=0x275607c*=0x0) returned 0x1 [0157.691] CoTaskMemFree (pv=0x100fd08) [0157.691] CoGetContextToken (in: pToken=0x18ed78 | out: pToken=0x18ed78) returned 0x0 [0157.692] WbemLocator:IUnknown:Release (This=0xff9cc0) returned 0x1 [0157.692] IUnknown:Release (This=0x1010d50) returned 0x0 [0157.737] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe", nBufferLength=0x105, lpBuffer=0x18e958, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe", lpFilePart=0x0) returned 0x41 [0157.738] GetEnvironmentVariableW (in: lpName="appdata", lpBuffer=0x18edb8, nSize=0x80 | out: lpBuffer="") returned 0x25 [0157.757] GetUserNameW (in: lpBuffer=0x18ecb8, pcbBuffer=0x2759b80 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x2759b80) returned 1 [0157.761] GetComputerNameW (in: lpBuffer=0x18ecb8, nSize=0x2759fec | out: lpBuffer="XC64ZB", nSize=0x2759fec) returned 1 [0157.770] GetCurrentProcessId () returned 0x12ec [0157.771] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x12ec) returned 0x470 [0157.771] GetExitCodeProcess (in: hProcess=0x470, lpExitCode=0x275a2c8 | out: lpExitCode=0x275a2c8*=0x103) returned 1 [0157.781] CheckRemoteDebuggerPresent (in: hProcess=0x470, pbDebuggerPresent=0x18ef10 | out: pbDebuggerPresent=0x18ef10) returned 1 [0157.801] GetACP () returned 0x4e4 [0157.827] GetCurrentProcess () returned 0xffffffff [0157.827] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ead4 | out: TokenHandle=0x18ead4*=0x478) returned 1 [0157.830] GetCurrentProcess () returned 0xffffffff [0157.830] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eae4 | out: TokenHandle=0x18eae4*=0x47c) returned 1 [0157.832] QueryPerformanceFrequency (in: lpFrequency=0xe25f20 | out: lpFrequency=0xe25f20*=100000000) returned 1 [0157.833] QueryPerformanceCounter (in: lpPerformanceCount=0x18ee58 | out: lpPerformanceCount=0x18ee58*=2293827864193) returned 1 [0157.838] GetCurrentProcess () returned 0xffffffff [0157.838] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eaa0 | out: TokenHandle=0x18eaa0*=0x480) returned 1 [0157.842] GetCurrentProcess () returned 0xffffffff [0157.842] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eab0 | out: TokenHandle=0x18eab0*=0x484) returned 1 [0157.862] GetCurrentProcess () returned 0xffffffff [0157.862] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eab4 | out: TokenHandle=0x18eab4*=0x488) returned 1 [0157.865] GetCurrentProcess () returned 0xffffffff [0157.865] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eac4 | out: TokenHandle=0x18eac4*=0x48c) returned 1 [0157.869] GetCurrentProcess () returned 0xffffffff [0157.869] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ed3c | out: TokenHandle=0x18ed3c*=0x490) returned 1 [0157.948] CoTaskMemAlloc (cb=0xcc0) returned 0x10156b0 [0157.949] RasEnumConnectionsW (in: param_1=0x10156b0, param_2=0x18ed4c, param_3=0x18ed50 | out: param_1=0x10156b0, param_2=0x18ed4c, param_3=0x18ed50) returned 0x0 [0157.977] CoTaskMemFree (pv=0x10156b0) [0157.983] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18eb34 | out: lpWSAData=0x18eb34) returned 0 [0157.992] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x4e0 [0158.012] setsockopt (s=0x4e0, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0158.012] closesocket (s=0x4e0) returned 0 [0158.012] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x4e0 [0158.014] setsockopt (s=0x4e0, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0158.014] closesocket (s=0x4e0) returned 0 [0158.014] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e0 [0158.015] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e4 [0158.015] ioctlsocket (in: s=0x4e0, cmd=-2147195266, argp=0x18ed54 | out: argp=0x18ed54) returned 0 [0158.015] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e8 [0158.015] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4ec [0158.016] ioctlsocket (in: s=0x4e8, cmd=-2147195266, argp=0x18ed54 | out: argp=0x18ed54) returned 0 [0158.017] WSAIoctl (in: s=0x4e0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18ed3c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18ed3c, lpOverlapped=0x0) returned -1 [0158.019] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18ea6c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0158.031] WSAEventSelect (s=0x4e0, hEventObject=0x4e4, lNetworkEvents=512) returned 0 [0158.031] WSAIoctl (in: s=0x4e8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18ed3c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18ed3c, lpOverlapped=0x0) returned -1 [0158.031] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18ea6c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0158.031] WSAEventSelect (s=0x4e8, hEventObject=0x4ec, lNetworkEvents=512) returned 0 [0158.031] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4f4 [0158.031] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x4f4, param_3=0x3) returned 0x0 [0158.038] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x18ed68 | out: phkResult=0x18ed68*=0x50c) returned 0x0 [0158.039] RegOpenKeyExW (in: hKey=0x50c, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ed1c | out: phkResult=0x18ed1c*=0x510) returned 0x0 [0158.039] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x514 [0158.039] RegNotifyChangeKeyValue (hKey=0x510, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x514, fAsynchronous=1) returned 0x0 [0158.040] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ed20 | out: phkResult=0x18ed20*=0x518) returned 0x0 [0158.040] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x51c [0158.040] RegNotifyChangeKeyValue (hKey=0x518, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x51c, fAsynchronous=1) returned 0x0 [0158.040] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ed20 | out: phkResult=0x18ed20*=0x520) returned 0x0 [0158.041] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x524 [0158.041] RegNotifyChangeKeyValue (hKey=0x520, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x524, fAsynchronous=1) returned 0x0 [0158.041] GetCurrentProcess () returned 0xffffffff [0158.041] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ed10 | out: TokenHandle=0x18ed10*=0x528) returned 1 [0158.044] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e618 | out: phkResult=0x18e618*=0x52c) returned 0x0 [0158.045] RegQueryValueExW (in: hKey=0x52c, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x18e634, lpData=0x0, lpcbData=0x18e630*=0x0 | out: lpType=0x18e634*=0x0, lpData=0x0, lpcbData=0x18e630*=0x0) returned 0x2 [0158.045] RegCloseKey (hKey=0x52c) returned 0x0 [0158.075] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x102e888 [0158.122] WinHttpSetTimeouts (hInternet=0x102e888, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0158.122] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x18ed1c | out: pProxyConfig=0x18ed1c) returned 1 [0158.178] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x18e590, nSize=0x80 | out: lpBuffer="") returned 0x0 [0158.178] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x18e590, nSize=0x80 | out: lpBuffer="") returned 0x0 [0158.186] EtwEventRegister (in: ProviderId=0x276330c, EnableCallback=0xee076e, CallbackContext=0x0, RegHandle=0x27632e8 | out: RegHandle=0x27632e8) returned 0x0 [0158.187] EtwEventSetInformation (RegHandle=0x1014988, InformationClass=0x4e, EventInformation=0x2, InformationLength=0x27632a8) returned 0x0 [0158.190] GetCurrentProcess () returned 0xffffffff [0158.190] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ea7c | out: TokenHandle=0x18ea7c*=0x574) returned 1 [0158.192] GetCurrentProcess () returned 0xffffffff [0158.192] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ea8c | out: TokenHandle=0x18ea8c*=0x578) returned 1 [0158.197] SetEvent (hEvent=0x230) returned 1 [0158.206] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ec64*=0x4f4, lpdwindex=0x18ea84 | out: lpdwindex=0x18ea84) returned 0x80010115 [0158.207] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ec44*=0x4e4, lpdwindex=0x18ea64 | out: lpdwindex=0x18ea64) returned 0x80010115 [0158.207] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ec44*=0x4ec, lpdwindex=0x18ea64 | out: lpdwindex=0x18ea64) returned 0x80010115 [0158.207] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ec98*=0x514, lpdwindex=0x18eab4 | out: lpdwindex=0x18eab4) returned 0x80010115 [0158.208] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ec98*=0x51c, lpdwindex=0x18eab4 | out: lpdwindex=0x18eab4) returned 0x80010115 [0158.208] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ec98*=0x524, lpdwindex=0x18eab4 | out: lpdwindex=0x18eab4) returned 0x80010115 [0158.211] GetCurrentProcess () returned 0xffffffff [0158.212] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e9d4 | out: TokenHandle=0x18e9d4*=0x590) returned 1 [0158.324] GetCurrentProcess () returned 0xffffffff [0158.324] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e9e4 | out: TokenHandle=0x18e9e4*=0x594) returned 1 [0158.327] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18eb54 | out: lpTimeZoneInformation=0x18eb54) returned 0x1 [0158.329] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x18e9b0 | out: pTimeZoneInformation=0x18e9b0) returned 0x1 [0158.340] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ea94 | out: phkResult=0x18ea94*=0x598) returned 0x0 [0158.342] RegQueryValueExW (in: hKey=0x598, lpValueName="TZI", lpReserved=0x0, lpType=0x18eab0, lpData=0x0, lpcbData=0x18eaac*=0x0 | out: lpType=0x18eab0*=0x3, lpData=0x0, lpcbData=0x18eaac*=0x2c) returned 0x0 [0158.342] RegQueryValueExW (in: hKey=0x598, lpValueName="TZI", lpReserved=0x0, lpType=0x18eab0, lpData=0x27660f8, lpcbData=0x18eaac*=0x2c | out: lpType=0x18eab0*=0x3, lpData=0x27660f8*, lpcbData=0x18eaac*=0x2c) returned 0x0 [0158.345] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e8e8 | out: phkResult=0x18e8e8*=0x0) returned 0x2 [0158.346] RegQueryValueExW (in: hKey=0x598, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x18ea88, lpData=0x0, lpcbData=0x18ea84*=0x0 | out: lpType=0x18ea88*=0x1, lpData=0x0, lpcbData=0x18ea84*=0x20) returned 0x0 [0158.348] RegQueryValueExW (in: hKey=0x598, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x18ea88, lpData=0x276651c, lpcbData=0x18ea84*=0x20 | out: lpType=0x18ea88*=0x1, lpData="@tzres.dll,-320", lpcbData=0x18ea84*=0x20) returned 0x0 [0158.348] RegQueryValueExW (in: hKey=0x598, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x18ea88, lpData=0x0, lpcbData=0x18ea84*=0x0 | out: lpType=0x18ea88*=0x1, lpData=0x0, lpcbData=0x18ea84*=0x20) returned 0x0 [0158.348] RegQueryValueExW (in: hKey=0x598, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x18ea88, lpData=0x2766574, lpcbData=0x18ea84*=0x20 | out: lpType=0x18ea88*=0x1, lpData="@tzres.dll,-322", lpcbData=0x18ea84*=0x20) returned 0x0 [0158.348] RegQueryValueExW (in: hKey=0x598, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x18ea88, lpData=0x0, lpcbData=0x18ea84*=0x0 | out: lpType=0x18ea88*=0x1, lpData=0x0, lpcbData=0x18ea84*=0x20) returned 0x0 [0158.349] RegQueryValueExW (in: hKey=0x598, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x18ea88, lpData=0x27665cc, lpcbData=0x18ea84*=0x20 | out: lpType=0x18ea88*=0x1, lpData="@tzres.dll,-321", lpcbData=0x18ea84*=0x20) returned 0x0 [0158.435] CoTaskMemAlloc (cb=0x20c) returned 0x1047f08 [0158.435] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1047f08 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0158.479] CoTaskMemFree (pv=0x1047f08) [0158.480] CoTaskMemAlloc (cb=0x20c) returned 0x1047f08 [0158.480] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x18eaa4, pwszFileMUIPath=0x1047f08, pcchFileMUIPath=0x18eaa8, pululEnumerator=0x18ea9c | out: pwszLanguage=0x0, pcchLanguage=0x18eaa4, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x18eaa8, pululEnumerator=0x18ea9c) returned 1 [0158.491] CoTaskMemFree (pv=0x0) [0158.491] CoTaskMemFree (pv=0x1047f08) [0158.492] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x25e0001 [0158.497] CoTaskMemAlloc (cb=0x3ec) returned 0x1047f08 [0158.497] LoadStringW (in: hInstance=0x25e0001, uID=0x140, lpBuffer=0x1047f08, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0158.498] CoTaskMemFree (pv=0x1047f08) [0158.498] FreeLibrary (hLibModule=0x25e0001) returned 1 [0158.498] CoTaskMemAlloc (cb=0x20c) returned 0x1047f08 [0158.498] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1047f08 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0158.498] CoTaskMemFree (pv=0x1047f08) [0158.498] CoTaskMemAlloc (cb=0x20c) returned 0x1047f08 [0158.498] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x18eaa4, pwszFileMUIPath=0x1047f08, pcchFileMUIPath=0x18eaa8, pululEnumerator=0x18ea9c | out: pwszLanguage=0x0, pcchLanguage=0x18eaa4, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x18eaa8, pululEnumerator=0x18ea9c) returned 1 [0158.500] CoTaskMemFree (pv=0x0) [0158.500] CoTaskMemFree (pv=0x1047f08) [0158.500] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x25e0001 [0158.501] CoTaskMemAlloc (cb=0x3ec) returned 0x1047f08 [0158.501] LoadStringW (in: hInstance=0x25e0001, uID=0x142, lpBuffer=0x1047f08, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0158.501] CoTaskMemFree (pv=0x1047f08) [0158.501] FreeLibrary (hLibModule=0x25e0001) returned 1 [0158.502] CoTaskMemAlloc (cb=0x20c) returned 0x1047f08 [0158.502] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1047f08 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0158.502] CoTaskMemFree (pv=0x1047f08) [0158.502] CoTaskMemAlloc (cb=0x20c) returned 0x1047f08 [0158.502] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x18eaa4, pwszFileMUIPath=0x1047f08, pcchFileMUIPath=0x18eaa8, pululEnumerator=0x18ea9c | out: pwszLanguage=0x0, pcchLanguage=0x18eaa4, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x18eaa8, pululEnumerator=0x18ea9c) returned 1 [0158.503] CoTaskMemFree (pv=0x0) [0158.503] CoTaskMemFree (pv=0x1047f08) [0158.503] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x25e0001 [0158.504] CoTaskMemAlloc (cb=0x3ec) returned 0x1047f08 [0158.504] LoadStringW (in: hInstance=0x25e0001, uID=0x141, lpBuffer=0x1047f08, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0158.504] CoTaskMemFree (pv=0x1047f08) [0158.504] FreeLibrary (hLibModule=0x25e0001) returned 1 [0158.505] RegCloseKey (hKey=0x598) returned 0x0 [0158.506] SetEvent (hEvent=0x230) returned 1 [0158.517] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x18ecb0 | out: pFixedInfo=0x0, pOutBufLen=0x18ecb0) returned 0x6f [0158.674] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x1047f08 [0158.674] GetNetworkParams (in: pFixedInfo=0x1047f08, pOutBufLen=0x18ecb0 | out: pFixedInfo=0x1047f08, pOutBufLen=0x18ecb0) returned 0x0 [0158.684] LocalFree (hMem=0x1047f08) returned 0x0 [0158.686] CoTaskMemAlloc (cb=0x20c) returned 0x1047f08 [0158.686] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x1047f08, nSize=0x104 | out: lpBuffer="") returned 0x0 [0158.686] CoTaskMemFree (pv=0x1047f08) [0158.686] CoTaskMemAlloc (cb=0x20c) returned 0x1047f08 [0158.686] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x1047f08, nSize=0x104 | out: lpBuffer="") returned 0x0 [0158.686] CoTaskMemFree (pv=0x1047f08) [0158.689] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5d8 [0158.691] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5b0 [0158.692] GetAddrInfoW (in: pNodeName="ip-api.com", pServiceName=0x0, pHints=0x18eb98*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18eb40 | out: ppResult=0x18eb40*=0xff4158*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ip-api.com", ai_addr=0x1030490*(sa_family=2, sin_port=0x0, sin_addr="208.95.112.1"), ai_next=0x0)) returned 0 [0158.743] FreeAddrInfoW (pAddrInfo=0xff4158*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ip-api.com", ai_addr=0x1030490*(sa_family=2, sin_port=0x0, sin_addr="208.95.112.1"), ai_next=0x0)) [0158.747] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5e0 [0158.747] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5e8 [0158.747] ioctlsocket (in: s=0x5e0, cmd=-2147195266, argp=0x18eb70 | out: argp=0x18eb70) returned 0 [0158.747] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x5ec [0158.747] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5f0 [0158.748] ioctlsocket (in: s=0x5ec, cmd=-2147195266, argp=0x18eb70 | out: argp=0x18eb70) returned 0 [0158.748] WSAIoctl (in: s=0x5e0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18eb58, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18eb58, lpOverlapped=0x0) returned -1 [0158.748] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18e888, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0158.748] WSAEventSelect (s=0x5e0, hEventObject=0x5e8, lNetworkEvents=512) returned 0 [0158.748] WSAIoctl (in: s=0x5ec, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18eb58, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18eb58, lpOverlapped=0x0) returned -1 [0158.748] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18e888, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0158.748] WSAEventSelect (s=0x5ec, hEventObject=0x5f0, lNetworkEvents=512) returned 0 [0158.748] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x18eb54*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x18eb54*=0xa80) returned 0x6f [0158.756] LocalAlloc (uFlags=0x0, uBytes=0xa80) returned 0x1040608 [0158.756] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x1040608, SizePointer=0x18eb54*=0xa80 | out: AdapterAddresses=0x1040608*(Alignment=0x600000178, Length=0x178, IfIndex=0x6, Next=0x10408b8, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x104082c, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0xa0, [1]=0xbf, [2]=0x50, [3]=0xe2, [4]=0x37, [5]=0xdc, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x6, ZoneIndices=([0]=0x6, [1]=0x6, [2]=0x6, [3]=0x6, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x1040780*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x18eb54*=0xa80) returned 0x0 [0158.768] LocalFree (hMem=0x1040608) returned 0x0 [0158.770] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x18eb70 | out: phkResult=0x18eb70*=0x5e4) returned 0x0 [0158.770] RegQueryValueExW (in: hKey=0x5e4, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x18eb8c, lpData=0x0, lpcbData=0x18eb88*=0x0 | out: lpType=0x18eb8c*=0x0, lpData=0x0, lpcbData=0x18eb88*=0x0) returned 0x2 [0158.770] RegCloseKey (hKey=0x5e4) returned 0x0 [0158.771] WSAConnect (in: s=0x5d8, name=0x27726ec*(sa_family=2, sin_port=0x50, sin_addr="208.95.112.1"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0158.791] closesocket (s=0x5b0) returned 0 [0158.796] send (s=0x5d8, buf=0x277323c*, len=80, flags=0) returned 80 [0158.798] setsockopt (s=0x5d8, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0158.799] recv (in: s=0x5d8, buf=0x276e75c, len=4096, flags=0 | out: buf=0x276e75c*) returned 175 [0158.845] setsockopt (s=0x5d8, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0158.845] SetEvent (hEvent=0x230) returned 1 [0158.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SbieDll.dll", cchWideChar=11, lpMultiByteStr=0x18eec0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SbieDll.dllo\x1bIé", lpUsedDefaultChar=0x0) returned 11 [0158.895] GetModuleHandleA (lpModuleName="SbieDll.dll") returned 0x0 [0158.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SxIn.dll", cchWideChar=8, lpMultiByteStr=0x18eec4, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SxIn.dll\x1bIé", lpUsedDefaultChar=0x0) returned 8 [0158.895] GetModuleHandleA (lpModuleName="SxIn.dll") returned 0x0 [0158.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sf2.dll", cchWideChar=7, lpMultiByteStr=0x18eec4, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sf2.dllo\x1bIé", lpUsedDefaultChar=0x0) returned 7 [0158.895] GetModuleHandleA (lpModuleName="Sf2.dll") returned 0x0 [0158.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="snxhk.dll", cchWideChar=9, lpMultiByteStr=0x18eec4, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="snxhk.dllIé", lpUsedDefaultChar=0x0) returned 9 [0158.895] GetModuleHandleA (lpModuleName="snxhk.dll") returned 0x0 [0158.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cmdvrt32.dll", cchWideChar=12, lpMultiByteStr=0x18eec0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cmdvrt32.dll\x1bIé", lpUsedDefaultChar=0x0) returned 12 [0158.896] GetModuleHandleA (lpModuleName="cmdvrt32.dll") returned 0x0 [0158.938] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18eeac | out: puCount=0x18eeac*=0x2) returned 0x0 [0158.938] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18eea8*=0x0, pszText=0x0 | out: puBuffLength=0x18eea8*=0xf, pszText=0x0) returned 0x0 [0158.938] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18eea8*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eea8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.946] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed54*=0x600, lpdwindex=0x18ec04 | out: lpdwindex=0x18ec04) returned 0x0 [0158.970] CoGetContextToken (in: pToken=0x18eb18 | out: pToken=0x18eb18) returned 0x0 [0158.970] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0158.970] IUnknown:QueryInterface (in: This=0xfb21f0, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea9c | out: ppvObject=0x18ea9c*=0xfb2200) returned 0x0 [0158.971] CObjectContext::ContextCallback () returned 0x0 [0158.972] IUnknown:Release (This=0xfb2200) returned 0x1 [0158.972] CoUnmarshalInterface (in: pStm=0xff29a0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb0c | out: ppv=0x18eb0c*=0xff90c0) returned 0x0 [0158.972] CoMarshalInterface (pStm=0xff29a0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff90c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0158.973] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9ac | out: ppvObject=0x18e9ac*=0xff90c0) returned 0x0 [0158.973] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e968 | out: ppvObject=0x18e968*=0x0) returned 0x80004002 [0158.973] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e784 | out: ppvObject=0x18e784*=0x0) returned 0x80004002 [0158.974] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e55c | out: ppvObject=0x18e55c*=0x0) returned 0x80004002 [0158.974] WbemLocator:IUnknown:AddRef (This=0xff90c0) returned 0x3 [0158.974] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e2bc | out: ppvObject=0x18e2bc*=0x0) returned 0x80004002 [0158.974] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e26c | out: ppvObject=0x18e26c*=0x0) returned 0x80004002 [0158.974] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e278 | out: ppvObject=0x18e278*=0xff901c) returned 0x0 [0158.974] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff901c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e280 | out: pCid=0x18e280*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.974] WbemLocator:IUnknown:Release (This=0xff901c) returned 0x3 [0158.974] CoGetContextToken (in: pToken=0x18e2d8 | out: pToken=0x18e2d8) returned 0x0 [0158.974] CoGetContextToken (in: pToken=0x18e6e0 | out: pToken=0x18e6e0) returned 0x0 [0158.974] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e76c | out: ppvObject=0x18e76c*=0xff90a4) returned 0x0 [0158.975] WbemLocator:IRpcOptions:Query (in: This=0xff90a4, pPrx=0xff90c0, dwProperty=2, pdwValue=0x18e778 | out: pdwValue=0x18e778) returned 0x0 [0158.975] WbemLocator:IUnknown:Release (This=0xff90a4) returned 0x3 [0158.975] WbemLocator:IUnknown:Release (This=0xff90c0) returned 0x2 [0158.975] WbemLocator:IUnknown:Release (This=0xff90c0) returned 0x1 [0158.975] CoGetContextToken (in: pToken=0x18ea58 | out: pToken=0x18ea58) returned 0x0 [0158.975] WbemLocator:IUnknown:AddRef (This=0xff90c0) returned 0x2 [0158.975] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed0c | out: ppvObject=0x18ed0c*=0xff909c) returned 0x0 [0158.975] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff909c, pProxy=0xff90c0, pAuthnSvc=0x18ed5c, pAuthzSvc=0x18ed58, pServerPrincName=0x18ed50, pAuthnLevel=0x18ed54, pImpLevel=0x18ed44, pAuthInfo=0x18ed48, pCapabilites=0x18ed4c | out: pAuthnSvc=0x18ed5c*=0xa, pAuthzSvc=0x18ed58*=0x0, pServerPrincName=0x18ed50, pAuthnLevel=0x18ed54*=0x6, pImpLevel=0x18ed44*=0x2, pAuthInfo=0x18ed48, pCapabilites=0x18ed4c*=0x1) returned 0x0 [0158.975] WbemLocator:IUnknown:Release (This=0xff909c) returned 0x2 [0158.975] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed00 | out: ppvObject=0x18ed00*=0xff90c0) returned 0x0 [0158.975] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecec | out: ppvObject=0x18ecec*=0xff909c) returned 0x0 [0158.975] WbemLocator:IClientSecurity:SetBlanket (This=0xff909c, pProxy=0xff90c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0158.975] WbemLocator:IUnknown:Release (This=0xff909c) returned 0x3 [0158.975] WbemLocator:IUnknown:Release (This=0xff90c0) returned 0x2 [0158.975] CoTaskMemFree (pv=0xfda520) [0158.976] WbemLocator:IUnknown:Release (This=0xff90c0) returned 0x1 [0158.976] SysStringLen (param_1=0x0) returned 0x0 [0158.976] CoGetContextToken (in: pToken=0x18ecc8 | out: pToken=0x18ecc8) returned 0x0 [0158.976] CoGetContextToken (in: pToken=0x18ec28 | out: pToken=0x18ec28) returned 0x0 [0158.976] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x18ecf8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18ecf4 | out: ppvObject=0x18ecf4*=0x103c148) returned 0x0 [0158.976] WbemLocator:IUnknown:AddRef (This=0x103c148) returned 0x3 [0158.976] WbemLocator:IUnknown:Release (This=0x103c148) returned 0x2 [0158.977] CoGetContextToken (in: pToken=0x18ec88 | out: pToken=0x18ec88) returned 0x0 [0158.977] WbemLocator:IUnknown:AddRef (This=0x103c148) returned 0x3 [0158.977] WbemLocator:IUnknown:QueryInterface (in: This=0x103c148, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed0c | out: ppvObject=0x18ed0c*=0xff909c) returned 0x0 [0158.977] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff909c, pProxy=0x103c148, pAuthnSvc=0x18ed5c, pAuthzSvc=0x18ed58, pServerPrincName=0x18ed50, pAuthnLevel=0x18ed54, pImpLevel=0x18ed44, pAuthInfo=0x18ed48, pCapabilites=0x18ed4c | out: pAuthnSvc=0x18ed5c*=0xa, pAuthzSvc=0x18ed58*=0x0, pServerPrincName=0x18ed50, pAuthnLevel=0x18ed54*=0x6, pImpLevel=0x18ed44*=0x2, pAuthInfo=0x18ed48, pCapabilites=0x18ed4c*=0x1) returned 0x0 [0158.977] WbemLocator:IUnknown:Release (This=0xff909c) returned 0x3 [0158.977] WbemLocator:IUnknown:QueryInterface (in: This=0x103c148, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed00 | out: ppvObject=0x18ed00*=0xff90c0) returned 0x0 [0158.977] WbemLocator:IUnknown:QueryInterface (in: This=0x103c148, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecec | out: ppvObject=0x18ecec*=0xff909c) returned 0x0 [0158.977] WbemLocator:IClientSecurity:SetBlanket (This=0xff909c, pProxy=0x103c148, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0158.977] WbemLocator:IUnknown:Release (This=0xff909c) returned 0x4 [0158.977] WbemLocator:IUnknown:Release (This=0xff90c0) returned 0x3 [0158.977] CoTaskMemFree (pv=0xfda280) [0158.977] WbemLocator:IUnknown:Release (This=0x103c148) returned 0x2 [0158.977] SysStringLen (param_1=0x0) returned 0x0 [0158.978] CoGetContextToken (in: pToken=0x18ec08 | out: pToken=0x18ec08) returned 0x0 [0158.978] WbemLocator:IUnknown:AddRef (This=0x103c148) returned 0x3 [0158.978] IWbemServices:ExecQuery (in: This=0x103c148, strQueryLanguage="WQL", strQuery="Select * from Win32_ComputerSystem", lFlags=16, pCtx=0x0, ppEnum=0x18ee1c | out: ppEnum=0x18ee1c*=0x1010af8) returned 0x0 [0159.078] IUnknown:QueryInterface (in: This=0x1010af8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec70 | out: ppvObject=0x18ec70*=0x1010afc) returned 0x0 [0159.078] IClientSecurity:QueryBlanket (in: This=0x1010afc, pProxy=0x1010af8, pAuthnSvc=0x18ecc0, pAuthzSvc=0x18ecbc, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8, pImpLevel=0x18eca8, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0 | out: pAuthnSvc=0x18ecc0*=0xa, pAuthzSvc=0x18ecbc*=0x0, pServerPrincName=0x18ecb4, pAuthnLevel=0x18ecb8*=0x6, pImpLevel=0x18eca8*=0x2, pAuthInfo=0x18ecac, pCapabilites=0x18ecb0*=0x1) returned 0x0 [0159.078] IUnknown:Release (This=0x1010afc) returned 0x1 [0159.078] IUnknown:QueryInterface (in: This=0x1010af8, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xff98c0) returned 0x0 [0159.078] IUnknown:QueryInterface (in: This=0x1010af8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec50 | out: ppvObject=0x18ec50*=0x1010afc) returned 0x0 [0159.078] IClientSecurity:SetBlanket (This=0x1010afc, pProxy=0x1010af8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0159.082] IUnknown:Release (This=0x1010afc) returned 0x2 [0159.082] WbemLocator:IUnknown:Release (This=0xff98c0) returned 0x1 [0159.082] CoTaskMemFree (pv=0xff3288) [0159.082] IUnknown:QueryInterface (in: This=0x1010af8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e85c | out: ppvObject=0x18e85c*=0xff98c0) returned 0x0 [0159.082] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e818 | out: ppvObject=0x18e818*=0x0) returned 0x80004002 [0159.087] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e634 | out: ppvObject=0x18e634*=0x0) returned 0x80004002 [0159.088] IUnknown:QueryInterface (in: This=0x1010af8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e40c | out: ppvObject=0x18e40c*=0x0) returned 0x80004002 [0159.088] WbemLocator:IUnknown:AddRef (This=0xff98c0) returned 0x3 [0159.088] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e16c | out: ppvObject=0x18e16c*=0x0) returned 0x80004002 [0159.088] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e11c | out: ppvObject=0x18e11c*=0x0) returned 0x80004002 [0159.088] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e128 | out: ppvObject=0x18e128*=0xff981c) returned 0x0 [0159.089] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff981c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e130 | out: pCid=0x18e130*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.089] WbemLocator:IUnknown:Release (This=0xff981c) returned 0x3 [0159.089] CoGetContextToken (in: pToken=0x18e188 | out: pToken=0x18e188) returned 0x0 [0159.089] CoGetContextToken (in: pToken=0x18e590 | out: pToken=0x18e590) returned 0x0 [0159.089] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e61c | out: ppvObject=0x18e61c*=0xff98a4) returned 0x0 [0159.089] WbemLocator:IRpcOptions:Query (in: This=0xff98a4, pPrx=0xff98c0, dwProperty=2, pdwValue=0x18e628 | out: pdwValue=0x18e628) returned 0x80004002 [0159.089] WbemLocator:IUnknown:Release (This=0xff98a4) returned 0x3 [0159.089] WbemLocator:IUnknown:Release (This=0xff98c0) returned 0x2 [0159.089] CoGetContextToken (in: pToken=0x18eb70 | out: pToken=0x18eb70) returned 0x0 [0159.089] CoGetContextToken (in: pToken=0x18ead0 | out: pToken=0x18ead0) returned 0x0 [0159.089] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x18eba0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18eb9c | out: ppvObject=0x18eb9c*=0x1010af8) returned 0x0 [0159.089] IUnknown:AddRef (This=0x1010af8) returned 0x4 [0159.089] IUnknown:Release (This=0x1010af8) returned 0x3 [0159.089] IUnknown:Release (This=0x1010af8) returned 0x2 [0159.089] WbemLocator:IUnknown:Release (This=0x103c148) returned 0x2 [0159.090] SysStringLen (param_1=0x0) returned 0x0 [0159.090] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee68 | out: puCount=0x18ee68*=0x2) returned 0x0 [0159.090] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee64*=0x0, pszText=0x0 | out: puBuffLength=0x18ee64*=0xf, pszText=0x0) returned 0x0 [0159.090] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee64*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee64*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.090] CoGetContextToken (in: pToken=0x18ecb8 | out: pToken=0x18ecb8) returned 0x0 [0159.090] IUnknown:AddRef (This=0x1010af8) returned 0x3 [0159.090] IEnumWbemClassObject:Clone (in: This=0x1010af8, ppEnum=0x18ee74 | out: ppEnum=0x18ee74*=0x1010bc0) returned 0x0 [0159.092] IUnknown:QueryInterface (in: This=0x1010bc0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed30 | out: ppvObject=0x18ed30*=0x1010bc4) returned 0x0 [0159.092] IClientSecurity:QueryBlanket (in: This=0x1010bc4, pProxy=0x1010bc0, pAuthnSvc=0x18ed80, pAuthzSvc=0x18ed7c, pServerPrincName=0x18ed74, pAuthnLevel=0x18ed78, pImpLevel=0x18ed68, pAuthInfo=0x18ed6c, pCapabilites=0x18ed70 | out: pAuthnSvc=0x18ed80*=0xa, pAuthzSvc=0x18ed7c*=0x0, pServerPrincName=0x18ed74, pAuthnLevel=0x18ed78*=0x6, pImpLevel=0x18ed68*=0x2, pAuthInfo=0x18ed6c, pCapabilites=0x18ed70*=0x1) returned 0x0 [0159.092] IUnknown:Release (This=0x1010bc4) returned 0x1 [0159.092] IUnknown:QueryInterface (in: This=0x1010bc0, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed24 | out: ppvObject=0x18ed24*=0xff93c0) returned 0x0 [0159.092] IUnknown:QueryInterface (in: This=0x1010bc0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed10 | out: ppvObject=0x18ed10*=0x1010bc4) returned 0x0 [0159.092] IClientSecurity:SetBlanket (This=0x1010bc4, pProxy=0x1010bc0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0159.095] IUnknown:Release (This=0x1010bc4) returned 0x2 [0159.095] WbemLocator:IUnknown:Release (This=0xff93c0) returned 0x1 [0159.095] CoTaskMemFree (pv=0xff2d78) [0159.095] IUnknown:QueryInterface (in: This=0x1010bc0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e90c | out: ppvObject=0x18e90c*=0xff93c0) returned 0x0 [0159.095] WbemLocator:IUnknown:QueryInterface (in: This=0xff93c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e8c8 | out: ppvObject=0x18e8c8*=0x0) returned 0x80004002 [0159.096] WbemLocator:IUnknown:QueryInterface (in: This=0xff93c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e6e4 | out: ppvObject=0x18e6e4*=0x0) returned 0x80004002 [0159.096] IUnknown:QueryInterface (in: This=0x1010bc0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e4bc | out: ppvObject=0x18e4bc*=0x0) returned 0x80004002 [0159.097] WbemLocator:IUnknown:AddRef (This=0xff93c0) returned 0x3 [0159.097] WbemLocator:IUnknown:QueryInterface (in: This=0xff93c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e21c | out: ppvObject=0x18e21c*=0x0) returned 0x80004002 [0159.097] WbemLocator:IUnknown:QueryInterface (in: This=0xff93c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e1cc | out: ppvObject=0x18e1cc*=0x0) returned 0x80004002 [0159.097] WbemLocator:IUnknown:QueryInterface (in: This=0xff93c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1d8 | out: ppvObject=0x18e1d8*=0xff931c) returned 0x0 [0159.097] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff931c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e1e0 | out: pCid=0x18e1e0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.097] WbemLocator:IUnknown:Release (This=0xff931c) returned 0x3 [0159.097] CoGetContextToken (in: pToken=0x18e238 | out: pToken=0x18e238) returned 0x0 [0159.097] CoGetContextToken (in: pToken=0x18e640 | out: pToken=0x18e640) returned 0x0 [0159.097] WbemLocator:IUnknown:QueryInterface (in: This=0xff93c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6cc | out: ppvObject=0x18e6cc*=0xff93a4) returned 0x0 [0159.097] WbemLocator:IRpcOptions:Query (in: This=0xff93a4, pPrx=0xff93c0, dwProperty=2, pdwValue=0x18e6d8 | out: pdwValue=0x18e6d8) returned 0x80004002 [0159.097] WbemLocator:IUnknown:Release (This=0xff93a4) returned 0x3 [0159.098] WbemLocator:IUnknown:Release (This=0xff93c0) returned 0x2 [0159.098] CoGetContextToken (in: pToken=0x18ec20 | out: pToken=0x18ec20) returned 0x0 [0159.098] CoGetContextToken (in: pToken=0x18eb80 | out: pToken=0x18eb80) returned 0x0 [0159.098] WbemLocator:IUnknown:QueryInterface (in: This=0xff93c0, riid=0x18ec50*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18ec4c | out: ppvObject=0x18ec4c*=0x1010bc0) returned 0x0 [0159.098] IUnknown:AddRef (This=0x1010bc0) returned 0x4 [0159.098] IUnknown:Release (This=0x1010bc0) returned 0x3 [0159.098] IUnknown:Release (This=0x1010bc0) returned 0x2 [0159.098] IUnknown:Release (This=0x1010af8) returned 0x2 [0159.098] SysStringLen (param_1=0x0) returned 0x0 [0159.098] IEnumWbemClassObject:Reset (This=0x1010bc0) returned 0x0 [0159.099] CoTaskMemAlloc (cb=0x4) returned 0x100fc58 [0159.099] IEnumWbemClassObject:Next (in: This=0x1010bc0, lTimeout=-1, uCount=0x1, apObjects=0x100fc58, puReturned=0x2776a08 | out: apObjects=0x100fc58*=0x1037128, puReturned=0x2776a08*=0x1) returned 0x0 [0159.105] IUnknown:QueryInterface (in: This=0x1037128, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e4d0 | out: ppvObject=0x18e4d0*=0x1037128) returned 0x0 [0159.105] IUnknown:QueryInterface (in: This=0x1037128, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e48c | out: ppvObject=0x18e48c*=0x0) returned 0x80004002 [0159.105] IUnknown:QueryInterface (in: This=0x1037128, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e2ac | out: ppvObject=0x18e2ac*=0x0) returned 0x80004002 [0159.106] IUnknown:QueryInterface (in: This=0x1037128, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e084 | out: ppvObject=0x18e084*=0x0) returned 0x80004002 [0159.106] IUnknown:AddRef (This=0x1037128) returned 0x3 [0159.106] IUnknown:QueryInterface (in: This=0x1037128, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dde4 | out: ppvObject=0x18dde4*=0x0) returned 0x80004002 [0159.106] IUnknown:QueryInterface (in: This=0x1037128, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd94 | out: ppvObject=0x18dd94*=0x0) returned 0x80004002 [0159.106] IUnknown:QueryInterface (in: This=0x1037128, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dda0 | out: ppvObject=0x18dda0*=0x103712c) returned 0x0 [0159.106] IMarshal:GetUnmarshalClass (in: This=0x103712c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dda8 | out: pCid=0x18dda8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0159.106] IUnknown:Release (This=0x103712c) returned 0x3 [0159.106] CoGetContextToken (in: pToken=0x18de00 | out: pToken=0x18de00) returned 0x0 [0159.106] CoGetContextToken (in: pToken=0x18e208 | out: pToken=0x18e208) returned 0x0 [0159.106] IUnknown:QueryInterface (in: This=0x1037128, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e294 | out: ppvObject=0x18e294*=0x0) returned 0x80004002 [0159.106] IUnknown:Release (This=0x1037128) returned 0x2 [0159.106] CoGetContextToken (in: pToken=0x18e7e0 | out: pToken=0x18e7e0) returned 0x0 [0159.106] CoGetContextToken (in: pToken=0x18e740 | out: pToken=0x18e740) returned 0x0 [0159.106] IUnknown:QueryInterface (in: This=0x1037128, riid=0x18e810*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e80c | out: ppvObject=0x18e80c*=0x1037128) returned 0x0 [0159.106] IUnknown:AddRef (This=0x1037128) returned 0x4 [0159.106] IUnknown:Release (This=0x1037128) returned 0x3 [0159.106] IUnknown:Release (This=0x1037128) returned 0x2 [0159.106] CoTaskMemFree (pv=0x100fc58) [0159.106] CoGetContextToken (in: pToken=0x18eb50 | out: pToken=0x18eb50) returned 0x0 [0159.106] IUnknown:AddRef (This=0x1037128) returned 0x3 [0159.107] IWbemClassObject:Get (in: This=0x1037128, wszName="__GENUS", lFlags=0, pVal=0x18ee64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eee4*=0, plFlavor=0x18eee0*=0 | out: pVal=0x18ee64*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eee4*=3, plFlavor=0x18eee0*=64) returned 0x0 [0159.107] IWbemClassObject:Get (in: This=0x1037128, wszName="__PATH", lFlags=0, pVal=0x18ee48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eecc*=0, plFlavor=0x18eec8*=0 | out: pVal=0x18ee48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ComputerSystem.Name=\"XC64ZB\"", varVal2=0x0), pType=0x18eecc*=8, plFlavor=0x18eec8*=64) returned 0x0 [0159.107] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ComputerSystem.Name=\"XC64ZB\"") returned 0x6c [0159.107] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ComputerSystem.Name=\"XC64ZB\"") returned 0x6c [0159.107] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x604 [0159.107] SetEvent (hEvent=0x30c) returned 1 [0159.108] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ee20*=0x604, lpdwindex=0x18ec3c | out: lpdwindex=0x18ec3c) returned 0x0 [0159.111] CoGetContextToken (in: pToken=0x18ecf0 | out: pToken=0x18ecf0) returned 0x0 [0159.111] CoGetContextToken (in: pToken=0x18ec50 | out: pToken=0x18ec50) returned 0x0 [0159.111] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037a60, riid=0x18ed20*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ed1c | out: ppvObject=0x18ed1c*=0x1037a60) returned 0x0 [0159.111] WbemDefPath:IUnknown:AddRef (This=0x1037a60) returned 0x3 [0159.111] WbemDefPath:IUnknown:Release (This=0x1037a60) returned 0x2 [0159.111] WbemDefPath:IWbemPath:SetText (This=0x1037a60, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ComputerSystem.Name=\"XC64ZB\"") returned 0x0 [0159.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18eea0 | out: puCount=0x18eea0*=0x2) returned 0x0 [0159.111] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee9c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee9c*=0xf, pszText=0x0) returned 0x0 [0159.111] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee9c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee9c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee6c | out: puCount=0x18ee6c*=0x2) returned 0x0 [0159.111] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee68*=0x0, pszText=0x0 | out: puBuffLength=0x18ee68*=0xf, pszText=0x0) returned 0x0 [0159.111] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee68*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee68*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.111] IWbemClassObject:Get (in: This=0x1037128, wszName="Manufacturer", lFlags=0, pVal=0x18ee68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2777260*=0, plFlavor=0x2777264*=0 | out: pVal=0x18ee68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TYAN Computer Corp", varVal2=0x0), pType=0x2777260*=8, plFlavor=0x2777264*=0) returned 0x0 [0159.111] SysStringByteLen (bstr="TYAN Computer Corp") returned 0x24 [0159.111] SysStringByteLen (bstr="TYAN Computer Corp") returned 0x24 [0159.111] IWbemClassObject:Get (in: This=0x1037128, wszName="Manufacturer", lFlags=0, pVal=0x18ee70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2777260*=8, plFlavor=0x2777264*=0 | out: pVal=0x18ee70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TYAN Computer Corp", varVal2=0x0), pType=0x2777260*=8, plFlavor=0x2777264*=0) returned 0x0 [0159.111] SysStringByteLen (bstr="TYAN Computer Corp") returned 0x24 [0159.112] SysStringByteLen (bstr="TYAN Computer Corp") returned 0x24 [0159.112] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee6c | out: puCount=0x18ee6c*=0x2) returned 0x0 [0159.112] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee68*=0x0, pszText=0x0 | out: puBuffLength=0x18ee68*=0xf, pszText=0x0) returned 0x0 [0159.112] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee68*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee68*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.112] IWbemClassObject:Get (in: This=0x1037128, wszName="Manufacturer", lFlags=0, pVal=0x18ee68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2777350*=0, plFlavor=0x2777354*=0 | out: pVal=0x18ee68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TYAN Computer Corp", varVal2=0x0), pType=0x2777350*=8, plFlavor=0x2777354*=0) returned 0x0 [0159.112] SysStringByteLen (bstr="TYAN Computer Corp") returned 0x24 [0159.112] SysStringByteLen (bstr="TYAN Computer Corp") returned 0x24 [0159.112] IWbemClassObject:Get (in: This=0x1037128, wszName="Manufacturer", lFlags=0, pVal=0x18ee70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2777350*=8, plFlavor=0x2777354*=0 | out: pVal=0x18ee70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TYAN Computer Corp", varVal2=0x0), pType=0x2777350*=8, plFlavor=0x2777354*=0) returned 0x0 [0159.112] SysStringByteLen (bstr="TYAN Computer Corp") returned 0x24 [0159.112] SysStringByteLen (bstr="TYAN Computer Corp") returned 0x24 [0159.112] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee6c | out: puCount=0x18ee6c*=0x2) returned 0x0 [0159.112] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee68*=0x0, pszText=0x0 | out: puBuffLength=0x18ee68*=0xf, pszText=0x0) returned 0x0 [0159.112] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee68*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee68*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0159.112] IWbemClassObject:Get (in: This=0x1037128, wszName="Model", lFlags=0, pVal=0x18ee68*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2777440*=0, plFlavor=0x2777444*=0 | out: pVal=0x18ee68*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="S2865", varVal2=0x0), pType=0x2777440*=8, plFlavor=0x2777444*=0) returned 0x0 [0159.112] SysStringByteLen (bstr="S2865") returned 0xa [0159.113] SysStringByteLen (bstr="S2865") returned 0xa [0159.113] IWbemClassObject:Get (in: This=0x1037128, wszName="Model", lFlags=0, pVal=0x18ee70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2777440*=8, plFlavor=0x2777444*=0 | out: pVal=0x18ee70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="S2865", varVal2=0x0), pType=0x2777440*=8, plFlavor=0x2777444*=0) returned 0x0 [0159.113] SysStringByteLen (bstr="S2865") returned 0xa [0159.113] SysStringByteLen (bstr="S2865") returned 0xa [0159.113] CoTaskMemAlloc (cb=0x4) returned 0x100fb68 [0159.113] IEnumWbemClassObject:Next (in: This=0x1010bc0, lTimeout=-1, uCount=0x1, apObjects=0x100fb68, puReturned=0x2776a08 | out: apObjects=0x100fb68*=0x0, puReturned=0x2776a08*=0x0) returned 0x1 [0159.114] CoTaskMemFree (pv=0x100fb68) [0159.114] CoGetContextToken (in: pToken=0x18ed98 | out: pToken=0x18ed98) returned 0x0 [0159.114] WbemLocator:IUnknown:Release (This=0xff93c0) returned 0x1 [0159.114] IUnknown:Release (This=0x1010bc0) returned 0x0 [0159.117] CoGetContextToken (in: pToken=0x18ed98 | out: pToken=0x18ed98) returned 0x0 [0159.117] WbemLocator:IUnknown:Release (This=0xff98c0) returned 0x1 [0159.117] IUnknown:Release (This=0x1010af8) returned 0x0 [0159.120] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x608 [0159.120] SetEvent (hEvent=0x30c) returned 1 [0159.120] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ee3c*=0x608, lpdwindex=0x18ec5c | out: lpdwindex=0x18ec5c) returned 0x0 [0159.123] CoGetContextToken (in: pToken=0x18ed08 | out: pToken=0x18ed08) returned 0x0 [0159.123] CoGetContextToken (in: pToken=0x18ec68 | out: pToken=0x18ec68) returned 0x0 [0159.123] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038390, riid=0x18ed38*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ed34 | out: ppvObject=0x18ed34*=0x1038390) returned 0x0 [0159.123] WbemDefPath:IUnknown:AddRef (This=0x1038390) returned 0x3 [0159.123] WbemDefPath:IUnknown:Release (This=0x1038390) returned 0x2 [0159.123] WbemDefPath:IWbemPath:SetText (This=0x1038390, uMode=0x4, pszPath="root\\CIMV2") returned 0x0 [0159.123] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1038390, puCount=0x18eeb8 | out: puCount=0x18eeb8*=0x2) returned 0x0 [0159.123] WbemDefPath:IWbemPath:GetText (in: This=0x1038390, lFlags=4, puBuffLength=0x18eeb4*=0x0, pszText=0x0 | out: puBuffLength=0x18eeb4*=0xf, pszText=0x0) returned 0x0 [0159.123] WbemDefPath:IWbemPath:GetText (in: This=0x1038390, lFlags=4, puBuffLength=0x18eeb4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eeb4*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0159.123] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1038390, puCount=0x18eea4 | out: puCount=0x18eea4*=0x2) returned 0x0 [0159.123] WbemDefPath:IWbemPath:GetText (in: This=0x1038390, lFlags=4, puBuffLength=0x18eea0*=0x0, pszText=0x0 | out: puBuffLength=0x18eea0*=0xf, pszText=0x0) returned 0x0 [0159.123] WbemDefPath:IWbemPath:GetText (in: This=0x1038390, lFlags=4, puBuffLength=0x18eea0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eea0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0159.132] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed54*=0x61c, lpdwindex=0x18ec04 | out: lpdwindex=0x18ec04) returned 0x0 [0159.167] CoGetContextToken (in: pToken=0x18eb18 | out: pToken=0x18eb18) returned 0x0 [0159.168] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0159.168] IUnknown:QueryInterface (in: This=0xfb21f0, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea9c | out: ppvObject=0x18ea9c*=0xfb2200) returned 0x0 [0159.168] CObjectContext::ContextCallback () returned 0x0 [0159.169] IUnknown:Release (This=0xfb2200) returned 0x1 [0159.169] CoUnmarshalInterface (in: pStm=0xff2740, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb0c | out: ppv=0x18eb0c*=0xff9ec0) returned 0x0 [0159.170] CoMarshalInterface (pStm=0xff2740, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff9ec0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0159.170] WbemLocator:IUnknown:QueryInterface (in: This=0xff9ec0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9ac | out: ppvObject=0x18e9ac*=0xff9ec0) returned 0x0 [0159.170] WbemLocator:IUnknown:QueryInterface (in: This=0xff9ec0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e968 | out: ppvObject=0x18e968*=0x0) returned 0x80004002 [0159.171] WbemLocator:IUnknown:QueryInterface (in: This=0xff9ec0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e784 | out: ppvObject=0x18e784*=0x0) returned 0x80004002 [0159.171] WbemLocator:IUnknown:QueryInterface (in: This=0xff9ec0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e55c | out: ppvObject=0x18e55c*=0x0) returned 0x80004002 [0159.172] WbemLocator:IUnknown:AddRef (This=0xff9ec0) returned 0x3 [0159.172] WbemLocator:IUnknown:QueryInterface (in: This=0xff9ec0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e2bc | out: ppvObject=0x18e2bc*=0x0) returned 0x80004002 [0159.172] WbemLocator:IUnknown:QueryInterface (in: This=0xff9ec0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e26c | out: ppvObject=0x18e26c*=0x0) returned 0x80004002 [0159.172] WbemLocator:IUnknown:QueryInterface (in: This=0xff9ec0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e278 | out: ppvObject=0x18e278*=0xff9e1c) returned 0x0 [0159.172] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff9e1c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e280 | out: pCid=0x18e280*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.172] WbemLocator:IUnknown:Release (This=0xff9e1c) returned 0x3 [0159.172] CoGetContextToken (in: pToken=0x18e2d8 | out: pToken=0x18e2d8) returned 0x0 [0159.172] CoGetContextToken (in: pToken=0x18e6e0 | out: pToken=0x18e6e0) returned 0x0 [0159.172] WbemLocator:IUnknown:QueryInterface (in: This=0xff9ec0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e76c | out: ppvObject=0x18e76c*=0xff9ea4) returned 0x0 [0159.172] WbemLocator:IRpcOptions:Query (in: This=0xff9ea4, pPrx=0xff9ec0, dwProperty=2, pdwValue=0x18e778 | out: pdwValue=0x18e778) returned 0x0 [0159.172] WbemLocator:IUnknown:Release (This=0xff9ea4) returned 0x3 [0159.173] WbemLocator:IUnknown:Release (This=0xff9ec0) returned 0x2 [0159.173] WbemLocator:IUnknown:Release (This=0xff9ec0) returned 0x1 [0159.173] CoGetContextToken (in: pToken=0x18ea58 | out: pToken=0x18ea58) returned 0x0 [0159.173] WbemLocator:IUnknown:AddRef (This=0xff9ec0) returned 0x2 [0159.173] WbemLocator:IUnknown:QueryInterface (in: This=0xff9ec0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed0c | out: ppvObject=0x18ed0c*=0xff9e9c) returned 0x0 [0159.173] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff9e9c, pProxy=0xff9ec0, pAuthnSvc=0x18ed5c, pAuthzSvc=0x18ed58, pServerPrincName=0x18ed50, pAuthnLevel=0x18ed54, pImpLevel=0x18ed44, pAuthInfo=0x18ed48, pCapabilites=0x18ed4c | out: pAuthnSvc=0x18ed5c*=0xa, pAuthzSvc=0x18ed58*=0x0, pServerPrincName=0x18ed50, pAuthnLevel=0x18ed54*=0x6, pImpLevel=0x18ed44*=0x2, pAuthInfo=0x18ed48, pCapabilites=0x18ed4c*=0x1) returned 0x0 [0159.173] WbemLocator:IUnknown:Release (This=0xff9e9c) returned 0x2 [0159.173] WbemLocator:IUnknown:QueryInterface (in: This=0xff9ec0, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed00 | out: ppvObject=0x18ed00*=0xff9ec0) returned 0x0 [0159.173] WbemLocator:IUnknown:QueryInterface (in: This=0xff9ec0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecec | out: ppvObject=0x18ecec*=0xff9e9c) returned 0x0 [0159.173] WbemLocator:IClientSecurity:SetBlanket (This=0xff9e9c, pProxy=0xff9ec0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0159.173] WbemLocator:IUnknown:Release (This=0xff9e9c) returned 0x3 [0159.173] WbemLocator:IUnknown:Release (This=0xff9ec0) returned 0x2 [0159.173] CoTaskMemFree (pv=0xfda280) [0159.174] WbemLocator:IUnknown:Release (This=0xff9ec0) returned 0x1 [0159.174] SysStringLen (param_1=0x0) returned 0x0 [0159.174] CoGetContextToken (in: pToken=0x18ecc8 | out: pToken=0x18ecc8) returned 0x0 [0159.174] CoGetContextToken (in: pToken=0x18ec28 | out: pToken=0x18ec28) returned 0x0 [0159.174] WbemLocator:IUnknown:QueryInterface (in: This=0xff9ec0, riid=0x18ecf8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18ecf4 | out: ppvObject=0x18ecf4*=0x103c328) returned 0x0 [0159.174] WbemLocator:IUnknown:AddRef (This=0x103c328) returned 0x3 [0159.174] WbemLocator:IUnknown:Release (This=0x103c328) returned 0x2 [0159.174] CoGetContextToken (in: pToken=0x18ec88 | out: pToken=0x18ec88) returned 0x0 [0159.174] WbemLocator:IUnknown:AddRef (This=0x103c328) returned 0x3 [0159.175] WbemLocator:IUnknown:QueryInterface (in: This=0x103c328, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed0c | out: ppvObject=0x18ed0c*=0xff9e9c) returned 0x0 [0159.175] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff9e9c, pProxy=0x103c328, pAuthnSvc=0x18ed5c, pAuthzSvc=0x18ed58, pServerPrincName=0x18ed50, pAuthnLevel=0x18ed54, pImpLevel=0x18ed44, pAuthInfo=0x18ed48, pCapabilites=0x18ed4c | out: pAuthnSvc=0x18ed5c*=0xa, pAuthzSvc=0x18ed58*=0x0, pServerPrincName=0x18ed50, pAuthnLevel=0x18ed54*=0x6, pImpLevel=0x18ed44*=0x2, pAuthInfo=0x18ed48, pCapabilites=0x18ed4c*=0x1) returned 0x0 [0159.175] WbemLocator:IUnknown:Release (This=0xff9e9c) returned 0x3 [0159.175] WbemLocator:IUnknown:QueryInterface (in: This=0x103c328, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed00 | out: ppvObject=0x18ed00*=0xff9ec0) returned 0x0 [0159.175] WbemLocator:IUnknown:QueryInterface (in: This=0x103c328, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ecec | out: ppvObject=0x18ecec*=0xff9e9c) returned 0x0 [0159.175] WbemLocator:IClientSecurity:SetBlanket (This=0xff9e9c, pProxy=0x103c328, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0159.175] WbemLocator:IUnknown:Release (This=0xff9e9c) returned 0x4 [0159.175] WbemLocator:IUnknown:Release (This=0xff9ec0) returned 0x3 [0159.175] CoTaskMemFree (pv=0xff3288) [0159.175] WbemLocator:IUnknown:Release (This=0x103c328) returned 0x2 [0159.175] SysStringLen (param_1=0x0) returned 0x0 [0159.175] CoGetContextToken (in: pToken=0x18ec00 | out: pToken=0x18ec00) returned 0x0 [0159.175] WbemLocator:IUnknown:AddRef (This=0x103c328) returned 0x3 [0159.176] IWbemServices:ExecQuery (in: This=0x103c328, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_VideoController", lFlags=16, pCtx=0x0, ppEnum=0x18ee1c | out: ppEnum=0x18ee1c*=0x1010bc0) returned 0x0 [0159.247] IUnknown:QueryInterface (in: This=0x1010bc0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec6c | out: ppvObject=0x18ec6c*=0x1010bc4) returned 0x0 [0159.247] IClientSecurity:QueryBlanket (in: This=0x1010bc4, pProxy=0x1010bc0, pAuthnSvc=0x18ecbc, pAuthzSvc=0x18ecb8, pServerPrincName=0x18ecb0, pAuthnLevel=0x18ecb4, pImpLevel=0x18eca4, pAuthInfo=0x18eca8, pCapabilites=0x18ecac | out: pAuthnSvc=0x18ecbc*=0xa, pAuthzSvc=0x18ecb8*=0x0, pServerPrincName=0x18ecb0, pAuthnLevel=0x18ecb4*=0x6, pImpLevel=0x18eca4*=0x2, pAuthInfo=0x18eca8, pCapabilites=0x18ecac*=0x1) returned 0x0 [0159.247] IUnknown:Release (This=0x1010bc4) returned 0x1 [0159.248] IUnknown:QueryInterface (in: This=0x1010bc0, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec60 | out: ppvObject=0x18ec60*=0xffa6c0) returned 0x0 [0159.248] IUnknown:QueryInterface (in: This=0x1010bc0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec4c | out: ppvObject=0x18ec4c*=0x1010bc4) returned 0x0 [0159.248] IClientSecurity:SetBlanket (This=0x1010bc4, pProxy=0x1010bc0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0159.254] IUnknown:Release (This=0x1010bc4) returned 0x2 [0159.254] WbemLocator:IUnknown:Release (This=0xffa6c0) returned 0x1 [0159.254] CoTaskMemFree (pv=0xfda280) [0159.254] IUnknown:QueryInterface (in: This=0x1010bc0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e858 | out: ppvObject=0x18e858*=0xffa6c0) returned 0x0 [0159.254] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e814 | out: ppvObject=0x18e814*=0x0) returned 0x80004002 [0159.255] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e634 | out: ppvObject=0x18e634*=0x0) returned 0x80004002 [0159.256] IUnknown:QueryInterface (in: This=0x1010bc0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e40c | out: ppvObject=0x18e40c*=0x0) returned 0x80004002 [0159.257] WbemLocator:IUnknown:AddRef (This=0xffa6c0) returned 0x3 [0159.257] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e16c | out: ppvObject=0x18e16c*=0x0) returned 0x80004002 [0159.257] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e11c | out: ppvObject=0x18e11c*=0x0) returned 0x80004002 [0159.257] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e128 | out: ppvObject=0x18e128*=0xffa61c) returned 0x0 [0159.257] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xffa61c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e130 | out: pCid=0x18e130*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.257] WbemLocator:IUnknown:Release (This=0xffa61c) returned 0x3 [0159.257] CoGetContextToken (in: pToken=0x18e188 | out: pToken=0x18e188) returned 0x0 [0159.257] CoGetContextToken (in: pToken=0x18e590 | out: pToken=0x18e590) returned 0x0 [0159.258] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e61c | out: ppvObject=0x18e61c*=0xffa6a4) returned 0x0 [0159.258] WbemLocator:IRpcOptions:Query (in: This=0xffa6a4, pPrx=0xffa6c0, dwProperty=2, pdwValue=0x18e628 | out: pdwValue=0x18e628) returned 0x80004002 [0159.258] WbemLocator:IUnknown:Release (This=0xffa6a4) returned 0x3 [0159.258] WbemLocator:IUnknown:Release (This=0xffa6c0) returned 0x2 [0159.258] CoGetContextToken (in: pToken=0x18eb68 | out: pToken=0x18eb68) returned 0x0 [0159.258] CoGetContextToken (in: pToken=0x18eac8 | out: pToken=0x18eac8) returned 0x0 [0159.258] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x18eb98*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18eb94 | out: ppvObject=0x18eb94*=0x1010bc0) returned 0x0 [0159.258] IUnknown:AddRef (This=0x1010bc0) returned 0x4 [0159.258] IUnknown:Release (This=0x1010bc0) returned 0x3 [0159.258] IUnknown:Release (This=0x1010bc0) returned 0x2 [0159.258] WbemLocator:IUnknown:Release (This=0x103c328) returned 0x2 [0159.258] SysStringLen (param_1=0x0) returned 0x0 [0159.258] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1038390, puCount=0x18ee68 | out: puCount=0x18ee68*=0x2) returned 0x0 [0159.258] WbemDefPath:IWbemPath:GetText (in: This=0x1038390, lFlags=4, puBuffLength=0x18ee64*=0x0, pszText=0x0 | out: puBuffLength=0x18ee64*=0xf, pszText=0x0) returned 0x0 [0159.258] WbemDefPath:IWbemPath:GetText (in: This=0x1038390, lFlags=4, puBuffLength=0x18ee64*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee64*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0159.258] CoGetContextToken (in: pToken=0x18ecb8 | out: pToken=0x18ecb8) returned 0x0 [0159.259] IUnknown:AddRef (This=0x1010bc0) returned 0x3 [0159.259] IEnumWbemClassObject:Clone (in: This=0x1010bc0, ppEnum=0x18ee74 | out: ppEnum=0x18ee74*=0x10104b8) returned 0x0 [0159.271] IUnknown:QueryInterface (in: This=0x10104b8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed30 | out: ppvObject=0x18ed30*=0x10104bc) returned 0x0 [0159.272] IClientSecurity:QueryBlanket (in: This=0x10104bc, pProxy=0x10104b8, pAuthnSvc=0x18ed80, pAuthzSvc=0x18ed7c, pServerPrincName=0x18ed74, pAuthnLevel=0x18ed78, pImpLevel=0x18ed68, pAuthInfo=0x18ed6c, pCapabilites=0x18ed70 | out: pAuthnSvc=0x18ed80*=0xa, pAuthzSvc=0x18ed7c*=0x0, pServerPrincName=0x18ed74, pAuthnLevel=0x18ed78*=0x6, pImpLevel=0x18ed68*=0x2, pAuthInfo=0x18ed6c, pCapabilites=0x18ed70*=0x1) returned 0x0 [0159.272] IUnknown:Release (This=0x10104bc) returned 0x1 [0159.272] IUnknown:QueryInterface (in: This=0x10104b8, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed24 | out: ppvObject=0x18ed24*=0xff98c0) returned 0x0 [0159.272] IUnknown:QueryInterface (in: This=0x10104b8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ed10 | out: ppvObject=0x18ed10*=0x10104bc) returned 0x0 [0159.272] IClientSecurity:SetBlanket (This=0x10104bc, pProxy=0x10104b8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0159.275] IUnknown:Release (This=0x10104bc) returned 0x2 [0159.275] WbemLocator:IUnknown:Release (This=0xff98c0) returned 0x1 [0159.275] CoTaskMemFree (pv=0x1053ba8) [0159.275] IUnknown:QueryInterface (in: This=0x10104b8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e90c | out: ppvObject=0x18e90c*=0xff98c0) returned 0x0 [0159.275] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e8c8 | out: ppvObject=0x18e8c8*=0x0) returned 0x80004002 [0159.276] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e6e4 | out: ppvObject=0x18e6e4*=0x0) returned 0x80004002 [0159.277] IUnknown:QueryInterface (in: This=0x10104b8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e4bc | out: ppvObject=0x18e4bc*=0x0) returned 0x80004002 [0159.278] WbemLocator:IUnknown:AddRef (This=0xff98c0) returned 0x3 [0159.278] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e21c | out: ppvObject=0x18e21c*=0x0) returned 0x80004002 [0159.278] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e1cc | out: ppvObject=0x18e1cc*=0x0) returned 0x80004002 [0159.278] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1d8 | out: ppvObject=0x18e1d8*=0xff981c) returned 0x0 [0159.279] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff981c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e1e0 | out: pCid=0x18e1e0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.279] WbemLocator:IUnknown:Release (This=0xff981c) returned 0x3 [0159.279] CoGetContextToken (in: pToken=0x18e238 | out: pToken=0x18e238) returned 0x0 [0159.279] CoGetContextToken (in: pToken=0x18e640 | out: pToken=0x18e640) returned 0x0 [0159.279] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6cc | out: ppvObject=0x18e6cc*=0xff98a4) returned 0x0 [0159.319] WbemLocator:IRpcOptions:Query (in: This=0xff98a4, pPrx=0xff98c0, dwProperty=2, pdwValue=0x18e6d8 | out: pdwValue=0x18e6d8) returned 0x80004002 [0159.319] WbemLocator:IUnknown:Release (This=0xff98a4) returned 0x3 [0159.319] WbemLocator:IUnknown:Release (This=0xff98c0) returned 0x2 [0159.319] CoGetContextToken (in: pToken=0x18ec20 | out: pToken=0x18ec20) returned 0x0 [0159.319] CoGetContextToken (in: pToken=0x18eb80 | out: pToken=0x18eb80) returned 0x0 [0159.319] WbemLocator:IUnknown:QueryInterface (in: This=0xff98c0, riid=0x18ec50*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18ec4c | out: ppvObject=0x18ec4c*=0x10104b8) returned 0x0 [0159.319] IUnknown:AddRef (This=0x10104b8) returned 0x4 [0159.319] IUnknown:Release (This=0x10104b8) returned 0x3 [0159.319] IUnknown:Release (This=0x10104b8) returned 0x2 [0159.319] IUnknown:Release (This=0x1010bc0) returned 0x2 [0159.319] SysStringLen (param_1=0x0) returned 0x0 [0159.319] IEnumWbemClassObject:Reset (This=0x10104b8) returned 0x0 [0159.322] CoTaskMemAlloc (cb=0x4) returned 0x100fb78 [0159.322] IEnumWbemClassObject:Next (in: This=0x10104b8, lTimeout=-1, uCount=0x1, apObjects=0x100fb78, puReturned=0x2778530 | out: apObjects=0x100fb78*=0x1054290, puReturned=0x2778530*=0x1) returned 0x0 [0159.330] IUnknown:QueryInterface (in: This=0x1054290, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e4d0 | out: ppvObject=0x18e4d0*=0x1054290) returned 0x0 [0159.330] IUnknown:QueryInterface (in: This=0x1054290, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e48c | out: ppvObject=0x18e48c*=0x0) returned 0x80004002 [0159.330] IUnknown:QueryInterface (in: This=0x1054290, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e2ac | out: ppvObject=0x18e2ac*=0x0) returned 0x80004002 [0159.330] IUnknown:QueryInterface (in: This=0x1054290, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e084 | out: ppvObject=0x18e084*=0x0) returned 0x80004002 [0159.330] IUnknown:AddRef (This=0x1054290) returned 0x3 [0159.330] IUnknown:QueryInterface (in: This=0x1054290, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dde4 | out: ppvObject=0x18dde4*=0x0) returned 0x80004002 [0159.330] IUnknown:QueryInterface (in: This=0x1054290, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd94 | out: ppvObject=0x18dd94*=0x0) returned 0x80004002 [0159.330] IUnknown:QueryInterface (in: This=0x1054290, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dda0 | out: ppvObject=0x18dda0*=0x1054294) returned 0x0 [0159.331] IMarshal:GetUnmarshalClass (in: This=0x1054294, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dda8 | out: pCid=0x18dda8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0159.331] IUnknown:Release (This=0x1054294) returned 0x3 [0159.331] CoGetContextToken (in: pToken=0x18de00 | out: pToken=0x18de00) returned 0x0 [0159.331] CoGetContextToken (in: pToken=0x18e208 | out: pToken=0x18e208) returned 0x0 [0159.331] IUnknown:QueryInterface (in: This=0x1054290, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e294 | out: ppvObject=0x18e294*=0x0) returned 0x80004002 [0159.331] IUnknown:Release (This=0x1054290) returned 0x2 [0159.331] CoGetContextToken (in: pToken=0x18e7e0 | out: pToken=0x18e7e0) returned 0x0 [0159.331] CoGetContextToken (in: pToken=0x18e740 | out: pToken=0x18e740) returned 0x0 [0159.331] IUnknown:QueryInterface (in: This=0x1054290, riid=0x18e810*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e80c | out: ppvObject=0x18e80c*=0x1054290) returned 0x0 [0159.331] IUnknown:AddRef (This=0x1054290) returned 0x4 [0159.331] IUnknown:Release (This=0x1054290) returned 0x3 [0159.331] IUnknown:Release (This=0x1054290) returned 0x2 [0159.331] CoTaskMemFree (pv=0x100fb78) [0159.331] CoGetContextToken (in: pToken=0x18eb50 | out: pToken=0x18eb50) returned 0x0 [0159.331] IUnknown:AddRef (This=0x1054290) returned 0x3 [0159.331] IWbemClassObject:Get (in: This=0x1054290, wszName="__GENUS", lFlags=0, pVal=0x18ee64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eee4*=0, plFlavor=0x18eee0*=0 | out: pVal=0x18ee64*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eee4*=3, plFlavor=0x18eee0*=64) returned 0x0 [0159.332] IWbemClassObject:Get (in: This=0x1054290, wszName="__PATH", lFlags=0, pVal=0x18ee48*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eecc*=0, plFlavor=0x18eec8*=0 | out: pVal=0x18ee48*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"", varVal2=0x0), pType=0x18eecc*=8, plFlavor=0x18eec8*=64) returned 0x0 [0159.332] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x8a [0159.332] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x8a [0159.332] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x620 [0159.332] SetEvent (hEvent=0x30c) returned 1 [0159.332] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ee20*=0x620, lpdwindex=0x18ec3c | out: lpdwindex=0x18ec3c) returned 0x0 [0159.335] CoGetContextToken (in: pToken=0x18ecf0 | out: pToken=0x18ecf0) returned 0x0 [0159.335] CoGetContextToken (in: pToken=0x18ec50 | out: pToken=0x18ec50) returned 0x0 [0159.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037750, riid=0x18ed20*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ed1c | out: ppvObject=0x18ed1c*=0x1037750) returned 0x0 [0159.335] WbemDefPath:IUnknown:AddRef (This=0x1037750) returned 0x3 [0159.335] WbemDefPath:IUnknown:Release (This=0x1037750) returned 0x2 [0159.336] WbemDefPath:IWbemPath:SetText (This=0x1037750, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x0 [0159.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1038390, puCount=0x18eea0 | out: puCount=0x18eea0*=0x2) returned 0x0 [0159.336] WbemDefPath:IWbemPath:GetText (in: This=0x1038390, lFlags=4, puBuffLength=0x18ee9c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee9c*=0xf, pszText=0x0) returned 0x0 [0159.336] WbemDefPath:IWbemPath:GetText (in: This=0x1038390, lFlags=4, puBuffLength=0x18ee9c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee9c*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0159.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1038390, puCount=0x18ee70 | out: puCount=0x18ee70*=0x2) returned 0x0 [0159.336] WbemDefPath:IWbemPath:GetText (in: This=0x1038390, lFlags=4, puBuffLength=0x18ee6c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee6c*=0xf, pszText=0x0) returned 0x0 [0159.336] WbemDefPath:IWbemPath:GetText (in: This=0x1038390, lFlags=4, puBuffLength=0x18ee6c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee6c*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0159.336] IWbemClassObject:Get (in: This=0x1054290, wszName="Name", lFlags=0, pVal=0x18ee6c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2778da4*=0, plFlavor=0x2778da8*=0 | out: pVal=0x18ee6c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) HD Graphics 610", varVal2=0x0), pType=0x2778da4*=8, plFlavor=0x2778da8*=0) returned 0x0 [0159.336] SysStringByteLen (bstr="Intel(R) HD Graphics 610") returned 0x30 [0159.336] SysStringByteLen (bstr="Intel(R) HD Graphics 610") returned 0x30 [0159.336] IWbemClassObject:Get (in: This=0x1054290, wszName="Name", lFlags=0, pVal=0x18ee74*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2778da4*=8, plFlavor=0x2778da8*=0 | out: pVal=0x18ee74*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) HD Graphics 610", varVal2=0x0), pType=0x2778da4*=8, plFlavor=0x2778da8*=0) returned 0x0 [0159.336] SysStringByteLen (bstr="Intel(R) HD Graphics 610") returned 0x30 [0159.336] SysStringByteLen (bstr="Intel(R) HD Graphics 610") returned 0x30 [0159.336] CoTaskMemAlloc (cb=0x4) returned 0x100fbf8 [0159.337] IEnumWbemClassObject:Next (in: This=0x10104b8, lTimeout=-1, uCount=0x1, apObjects=0x100fbf8, puReturned=0x2778530 | out: apObjects=0x100fbf8*=0x0, puReturned=0x2778530*=0x0) returned 0x1 [0159.338] CoTaskMemFree (pv=0x100fbf8) [0159.338] CoGetContextToken (in: pToken=0x18ed98 | out: pToken=0x18ed98) returned 0x0 [0159.338] WbemLocator:IUnknown:Release (This=0xff98c0) returned 0x1 [0159.338] IUnknown:Release (This=0x10104b8) returned 0x0 [0159.492] CoTaskMemAlloc (cb=0x20c) returned 0x1057890 [0159.492] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x1057890 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0159.494] CoTaskMemFree (pv=0x1057890) [0159.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x18d150, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0159.494] CoTaskMemAlloc (cb=0x20c) returned 0x1057890 [0159.494] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x1057890, nSize=0x104 | out: lpBuffer="") returned 0x25 [0159.494] CoTaskMemFree (pv=0x1057890) [0159.578] CoTaskMemAlloc (cb=0x20c) returned 0x1057890 [0159.578] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1057890 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0159.578] CoTaskMemFree (pv=0x1057890) [0159.578] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x18e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0159.719] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable", nBufferLength=0x105, lpBuffer=0x18e878, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable", lpFilePart=0x0) returned 0x41 [0159.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed1c) returned 1 [0159.720] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable"), fInfoLevelId=0x0, lpFileInformation=0x18ed98 | out: lpFileInformation=0x18ed98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0159.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed18) returned 1 [0159.721] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x18e878, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpFilePart=0x0) returned 0x42 [0159.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed1c) returned 1 [0159.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yandexbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x18ed98 | out: lpFileInformation=0x18ed98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0159.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed18) returned 1 [0159.721] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", nBufferLength=0x105, lpBuffer=0x18e878, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", lpFilePart=0x0) returned 0x36 [0159.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed1c) returned 1 [0159.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data"), fInfoLevelId=0x0, lpFileInformation=0x18ed98 | out: lpFileInformation=0x18ed98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0159.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed18) returned 1 [0159.722] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", nBufferLength=0x105, lpBuffer=0x18e878, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", lpFilePart=0x0) returned 0x33 [0159.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed1c) returned 1 [0159.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data"), fInfoLevelId=0x0, lpFileInformation=0x18ed98 | out: lpFileInformation=0x18ed98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0159.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed18) returned 1 [0159.722] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Chrome\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x18e878, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Chrome\\Chrome\\User Data", lpFilePart=0x0) returned 0x3e [0159.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed1c) returned 1 [0159.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Chrome\\Chrome\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360chrome\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x18ed98 | out: lpFileInformation=0x18ed98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0159.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed18) returned 1 [0159.722] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x18e878, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x3b [0159.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed1c) returned 1 [0159.723] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x18ed98 | out: lpFileInformation=0x18ed98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0159.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed18) returned 1 [0159.723] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", nBufferLength=0x105, lpBuffer=0x18e878, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", lpFilePart=0x0) returned 0x3c [0159.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed1c) returned 1 [0159.723] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data"), fInfoLevelId=0x0, lpFileInformation=0x18ed98 | out: lpFileInformation=0x18ed98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0159.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed18) returned 1 [0159.834] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x18e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x42 [0159.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ecc4) returned 1 [0159.835] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0159.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18d388) returned 1 [0159.916] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x18e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x42 [0159.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ecc4) returned 1 [0159.916] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0159.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18d388) returned 1 [0159.971] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", nBufferLength=0x105, lpBuffer=0x18e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", lpFilePart=0x0) returned 0x44 [0159.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ecc4) returned 1 [0159.971] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0159.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18d388) returned 1 [0159.973] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", nBufferLength=0x105, lpBuffer=0x18e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", lpFilePart=0x0) returned 0x44 [0159.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ecc4) returned 1 [0159.973] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0159.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18d388) returned 1 [0159.975] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", nBufferLength=0x105, lpBuffer=0x18e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", lpFilePart=0x0) returned 0x3e [0159.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ecc4) returned 1 [0159.975] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0159.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18d388) returned 1 [0159.977] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", nBufferLength=0x105, lpBuffer=0x18e78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini", lpFilePart=0x0) returned 0x3e [0159.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ecc4) returned 1 [0159.977] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0159.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18d388) returned 1 [0160.099] VaultEnumerateVaults () returned 0x0 [0160.116] VaultOpenVault () returned 0x0 [0160.128] VaultEnumerateItems () returned 0x0 [0160.128] VaultOpenVault () returned 0x0 [0160.129] VaultEnumerateItems () returned 0x0 [0160.156] CoTaskMemAlloc (cb=0x20c) returned 0x104e2f0 [0160.156] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x104e2f0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0160.156] CoTaskMemFree (pv=0x104e2f0) [0160.156] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x18e86c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0160.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ee18) returned 1 [0160.158] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", nBufferLength=0x105, lpBuffer=0x18e8d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\", lpFilePart=0x0) returned 0x2e [0160.159] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\UCBrowser\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucbrowser\\*"), lpFindFileData=0x18eb40 | out: lpFindFileData=0x18eb40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0160.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eddc) returned 1 [0160.172] CoTaskMemAlloc (cb=0x20c) returned 0x104e2f0 [0160.172] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x104e2f0 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0160.175] CoTaskMemFree (pv=0x104e2f0) [0160.175] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x18e87c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0160.175] CoTaskMemAlloc (cb=0x20c) returned 0x104e2f0 [0160.175] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x104e2f0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0160.175] CoTaskMemFree (pv=0x104e2f0) [0160.175] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x18e87c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0160.200] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe", nBufferLength=0x105, lpBuffer=0x18e8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe", lpFilePart=0x0) returned 0x4e [0160.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed9c) returned 1 [0160.200] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe" (normalized: "c:\\program files (x86)\\common files\\apple\\apple application support\\plutil.exe"), fInfoLevelId=0x0, lpFileInformation=0x18ee18 | out: lpFileInformation=0x18ee18*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed98) returned 1 [0160.248] CoTaskMemAlloc (cb=0x20c) returned 0x104e2f0 [0160.248] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x104e2f0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0160.249] CoTaskMemFree (pv=0x104e2f0) [0160.249] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x18e848, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0160.249] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x18e8d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data", lpFilePart=0x0) returned 0x3f [0160.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed7c) returned 1 [0160.249] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tencent\\qqbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x18edf8 | out: lpFileInformation=0x18edf8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed78) returned 1 [0160.249] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage", nBufferLength=0x105, lpBuffer=0x18e8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage", lpFilePart=0x0) returned 0x58 [0160.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed88) returned 1 [0160.249] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tencent\\qqbrowser\\user data\\default\\encryptedstorage"), fInfoLevelId=0x0, lpFileInformation=0x18ee04 | out: lpFileInformation=0x18ee04*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed84) returned 1 [0160.341] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\11.0\\Outlook\\Profiles", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ede8 | out: phkResult=0x18ede8*=0x0) returned 0x2 [0160.344] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\12.0\\Outlook\\Profiles", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ede8 | out: phkResult=0x18ede8*=0x0) returned 0x2 [0160.344] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\14.0\\Outlook\\Profiles", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ede8 | out: phkResult=0x18ede8*=0x0) returned 0x2 [0160.345] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ede8 | out: phkResult=0x18ede8*=0x0) returned 0x2 [0160.345] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ede8 | out: phkResult=0x18ede8*=0x0) returned 0x2 [0160.345] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ede8 | out: phkResult=0x18ede8*=0x0) returned 0x2 [0160.346] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ede8 | out: phkResult=0x18ede8*=0x640) returned 0x0 [0160.347] RegQueryInfoKeyW (in: hKey=0x640, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x18ee10, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x18ee0c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x18ee10*=0x1, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x18ee0c*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0160.347] RegEnumKeyExW (in: hKey=0x640, dwIndex=0x0, lpName=0x26fb7f8, lpcchName=0x18ee2c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Outlook", lpcchName=0x18ee2c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0160.347] RegOpenKeyExW (in: hKey=0x640, lpSubKey="Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ede8 | out: phkResult=0x18ede8*=0x644) returned 0x0 [0160.347] RegQueryInfoKeyW (in: hKey=0x644, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x18ee10, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x18ee0c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x18ee10*=0x3, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x18ee0c*=0x6, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0160.347] RegEnumKeyExW (in: hKey=0x644, dwIndex=0x0, lpName=0x26fbc8c, lpcchName=0x18ee2c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000001", lpcchName=0x18ee2c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0160.347] CoTaskMemFree (pv=0x0) [0160.347] RegEnumKeyExW (in: hKey=0x644, dwIndex=0x1, lpName=0x26fbc8c, lpcchName=0x18ee2c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000002", lpcchName=0x18ee2c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0160.347] CoTaskMemFree (pv=0x0) [0160.347] RegEnumKeyExW (in: hKey=0x644, dwIndex=0x2, lpName=0x26fbc8c, lpcchName=0x18ee2c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000003", lpcchName=0x18ee2c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0160.349] CoTaskMemFree (pv=0x0) [0160.349] RegOpenKeyExW (in: hKey=0x644, lpSubKey="00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ede8 | out: phkResult=0x18ede8*=0x648) returned 0x0 [0160.350] RegQueryValueExW (in: hKey=0x648, lpValueName="Email", lpReserved=0x0, lpType=0x18ee08, lpData=0x0, lpcbData=0x18ee04*=0x0 | out: lpType=0x18ee08*=0x0, lpData=0x0, lpcbData=0x18ee04*=0x0) returned 0x2 [0160.350] RegCloseKey (hKey=0x648) returned 0x0 [0160.350] RegOpenKeyExW (in: hKey=0x644, lpSubKey="00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ede8 | out: phkResult=0x18ede8*=0x648) returned 0x0 [0160.350] RegQueryValueExW (in: hKey=0x648, lpValueName="Email", lpReserved=0x0, lpType=0x18ee08, lpData=0x0, lpcbData=0x18ee04*=0x0 | out: lpType=0x18ee08*=0x1, lpData=0x0, lpcbData=0x18ee04*=0x1e) returned 0x0 [0160.350] RegQueryValueExW (in: hKey=0x648, lpValueName="Email", lpReserved=0x0, lpType=0x18ee08, lpData=0x26fc150, lpcbData=0x18ee04*=0x1e | out: lpType=0x18ee08*=0x1, lpData="achoo@gdllo.de", lpcbData=0x18ee04*=0x1e) returned 0x0 [0160.350] RegQueryValueExW (in: hKey=0x648, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x18ee08, lpData=0x0, lpcbData=0x18ee04*=0x0 | out: lpType=0x18ee08*=0x0, lpData=0x0, lpcbData=0x18ee04*=0x0) returned 0x2 [0160.350] RegQueryValueExW (in: hKey=0x648, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x18ee08, lpData=0x0, lpcbData=0x18ee04*=0x0 | out: lpType=0x18ee08*=0x3, lpData=0x0, lpcbData=0x18ee04*=0x121) returned 0x0 [0160.350] RegQueryValueExW (in: hKey=0x648, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x18ee08, lpData=0x26fc1a8, lpcbData=0x18ee04*=0x121 | out: lpType=0x18ee08*=0x3, lpData=0x26fc1a8*, lpcbData=0x18ee04*=0x121) returned 0x0 [0160.357] RegQueryValueExW (in: hKey=0x648, lpValueName="Email", lpReserved=0x0, lpType=0x18ee08, lpData=0x0, lpcbData=0x18ee04*=0x0 | out: lpType=0x18ee08*=0x1, lpData=0x0, lpcbData=0x18ee04*=0x1e) returned 0x0 [0160.357] RegQueryValueExW (in: hKey=0x648, lpValueName="Email", lpReserved=0x0, lpType=0x18ee08, lpData=0x26fc2f0, lpcbData=0x18ee04*=0x1e | out: lpType=0x18ee08*=0x1, lpData="achoo@gdllo.de", lpcbData=0x18ee04*=0x1e) returned 0x0 [0160.357] RegQueryValueExW (in: hKey=0x648, lpValueName="Email", lpReserved=0x0, lpType=0x18ee08, lpData=0x0, lpcbData=0x18ee04*=0x0 | out: lpType=0x18ee08*=0x1, lpData=0x0, lpcbData=0x18ee04*=0x1e) returned 0x0 [0160.357] RegQueryValueExW (in: hKey=0x648, lpValueName="Email", lpReserved=0x0, lpType=0x18ee08, lpData=0x26fc348, lpcbData=0x18ee04*=0x1e | out: lpType=0x18ee08*=0x1, lpData="achoo@gdllo.de", lpcbData=0x18ee04*=0x1e) returned 0x0 [0160.357] RegQueryValueExW (in: hKey=0x648, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x18ee08, lpData=0x0, lpcbData=0x18ee04*=0x0 | out: lpType=0x18ee08*=0x0, lpData=0x0, lpcbData=0x18ee04*=0x0) returned 0x2 [0160.357] RegQueryValueExW (in: hKey=0x648, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x18ee08, lpData=0x0, lpcbData=0x18ee04*=0x0 | out: lpType=0x18ee08*=0x3, lpData=0x0, lpcbData=0x18ee04*=0x121) returned 0x0 [0160.357] RegQueryValueExW (in: hKey=0x648, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x18ee08, lpData=0x26fc3bc, lpcbData=0x18ee04*=0x121 | out: lpType=0x18ee08*=0x3, lpData=0x26fc3bc*, lpcbData=0x18ee04*=0x121) returned 0x0 [0160.358] RegQueryValueExW (in: hKey=0x648, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x18ee08, lpData=0x0, lpcbData=0x18ee04*=0x0 | out: lpType=0x18ee08*=0x3, lpData=0x0, lpcbData=0x18ee04*=0x121) returned 0x0 [0160.358] RegQueryValueExW (in: hKey=0x648, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x18ee08, lpData=0x26fc4ec, lpcbData=0x18ee04*=0x121 | out: lpType=0x18ee08*=0x3, lpData=0x26fc4ec*, lpcbData=0x18ee04*=0x121) returned 0x0 [0160.514] CryptUnprotectData (in: pDataIn=0x18edd0, ppszDataDescr=0x0, pOptionalEntropy=0x18edc8, pvReserved=0x0, pPromptStruct=0x0, dwFlags=0x1, pDataOut=0x18edd8 | out: ppszDataDescr=0x0, pDataOut=0x18edd8) returned 1 [0160.528] LocalFree (hMem=0xff1bd8) returned 0x0 [0160.529] RegQueryValueExW (in: hKey=0x648, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x18ee08, lpData=0x0, lpcbData=0x18ee04*=0x0 | out: lpType=0x18ee08*=0x1, lpData=0x0, lpcbData=0x18ee04*=0x1a) returned 0x0 [0160.530] RegQueryValueExW (in: hKey=0x648, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x18ee08, lpData=0x26fc92c, lpcbData=0x18ee04*=0x1a | out: lpType=0x18ee08*=0x1, lpData="pop.gdllo.de", lpcbData=0x18ee04*=0x1a) returned 0x0 [0160.530] RegQueryValueExW (in: hKey=0x648, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x18ee08, lpData=0x0, lpcbData=0x18ee04*=0x0 | out: lpType=0x18ee08*=0x1, lpData=0x0, lpcbData=0x18ee04*=0x1a) returned 0x0 [0160.530] RegQueryValueExW (in: hKey=0x648, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x18ee08, lpData=0x26fc97c, lpcbData=0x18ee04*=0x1a | out: lpType=0x18ee08*=0x1, lpData="pop.gdllo.de", lpcbData=0x18ee04*=0x1a) returned 0x0 [0160.530] RegCloseKey (hKey=0x648) returned 0x0 [0160.530] RegOpenKeyExW (in: hKey=0x644, lpSubKey="00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ede8 | out: phkResult=0x18ede8*=0x648) returned 0x0 [0160.530] RegQueryValueExW (in: hKey=0x648, lpValueName="Email", lpReserved=0x0, lpType=0x18ee08, lpData=0x0, lpcbData=0x18ee04*=0x0 | out: lpType=0x18ee08*=0x0, lpData=0x0, lpcbData=0x18ee04*=0x0) returned 0x2 [0160.530] RegCloseKey (hKey=0x648) returned 0x0 [0160.603] SetEnvironmentVariableW (lpName="COMPlus_legacyCorruptedStateExceptionsPolicy", lpValue="1") returned 1 [0160.603] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\ActiveSync\\Partners", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ed7c | out: phkResult=0x18ed7c*=0x648) returned 0x0 [0160.603] RegQueryInfoKeyW (in: hKey=0x648, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x18eda4, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x18eda0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x18eda4*=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x18eda0*=0x1, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0160.695] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Aerofox\\FoxmailPreview", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ed18 | out: phkResult=0x18ed18*=0x0) returned 0x2 [0160.699] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Aerofox\\Foxmail\\V3.1", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ed18 | out: phkResult=0x18ed18*=0x0) returned 0x2 [0160.700] CoTaskMemAlloc (cb=0x20c) returned 0x104e2f0 [0160.700] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x104e2f0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0160.700] CoTaskMemFree (pv=0x104e2f0) [0160.700] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x18e7a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0160.700] GetFullPathNameW (in: lpFileName="\\Storage\\", nBufferLength=0x105, lpBuffer=0x18e834, lpFilePart=0x0 | out: lpBuffer="C:\\Storage\\", lpFilePart=0x0) returned 0xb [0160.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ecd8) returned 1 [0160.701] GetFileAttributesExW (in: lpFileName="C:\\Storage\\" (normalized: "c:\\storage"), fInfoLevelId=0x0, lpFileInformation=0x18ed54 | out: lpFileInformation=0x18ed54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ecd4) returned 1 [0160.701] GetFullPathNameW (in: lpFileName="\\mail", nBufferLength=0x105, lpBuffer=0x18e834, lpFilePart=0x0 | out: lpBuffer="C:\\mail", lpFilePart=0x0) returned 0x7 [0160.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ecd8) returned 1 [0160.701] GetFileAttributesExW (in: lpFileName="C:\\mail" (normalized: "c:\\mail"), fInfoLevelId=0x0, lpFileInformation=0x18ed54 | out: lpFileInformation=0x18ed54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ecd4) returned 1 [0160.701] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail", nBufferLength=0x105, lpBuffer=0x18e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail", lpFilePart=0x0) returned 0x4b [0160.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ecd8) returned 1 [0160.702] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\virtualstore\\program files\\foxmail\\mail"), fInfoLevelId=0x0, lpFileInformation=0x18ed54 | out: lpFileInformation=0x18ed54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ecd4) returned 1 [0160.702] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail", nBufferLength=0x105, lpBuffer=0x18e834, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail", lpFilePart=0x0) returned 0x51 [0160.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ecd8) returned 1 [0160.702] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\virtualstore\\program files (x86)\\foxmail\\mail"), fInfoLevelId=0x0, lpFileInformation=0x18ed54 | out: lpFileInformation=0x18ed54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ecd4) returned 1 [0160.759] CoTaskMemAlloc (cb=0x20c) returned 0x104e2f0 [0160.759] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x104e2f0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0160.759] CoTaskMemFree (pv=0x104e2f0) [0160.760] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x18e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0160.760] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat", nBufferLength=0x105, lpBuffer=0x18e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat", lpFilePart=0x0) returned 0x44 [0160.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed98) returned 1 [0160.760] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera mail\\opera mail\\wand.dat"), fInfoLevelId=0x0, lpFileInformation=0x18ee14 | out: lpFileInformation=0x18ee14*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed94) returned 1 [0160.820] CoTaskMemAlloc (cb=0x20c) returned 0x104e2f0 [0160.820] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x104e2f0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0160.820] CoTaskMemFree (pv=0x104e2f0) [0160.820] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x18e850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0160.820] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db", nBufferLength=0x105, lpBuffer=0x18e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db", lpFilePart=0x0) returned 0x3b [0160.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed90) returned 1 [0160.820] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\mailbird\\store\\store.db"), fInfoLevelId=0x0, lpFileInformation=0x18ee0c | out: lpFileInformation=0x18ee0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed8c) returned 1 [0160.821] CoTaskMemAlloc (cb=0x20c) returned 0x104e2f0 [0160.821] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x104e2f0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0160.821] CoTaskMemFree (pv=0x104e2f0) [0160.821] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x18e850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0160.821] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db", nBufferLength=0x105, lpBuffer=0x18e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db", lpFilePart=0x0) returned 0x3b [0160.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ed90) returned 1 [0160.821] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mailbird\\Store\\Store.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\mailbird\\store\\store.db"), fInfoLevelId=0x0, lpFileInformation=0x18ee0c | out: lpFileInformation=0x18ee0c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0160.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ed8c) returned 1 [0160.893] GetUserNameW (in: lpBuffer=0x18ec5c, pcbBuffer=0x2701100 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x2701100) returned 1 [0160.894] GetComputerNameW (in: lpBuffer=0x18ec5c, nSize=0x270156c | out: lpBuffer="XC64ZB", nSize=0x270156c) returned 1 [0161.082] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee40 | out: puCount=0x18ee40*=0x2) returned 0x0 [0161.082] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee3c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee3c*=0xf, pszText=0x0) returned 0x0 [0161.082] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.125] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x65c [0161.125] SetEvent (hEvent=0x30c) returned 1 [0161.125] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed98*=0x65c, lpdwindex=0x18ebb4 | out: lpdwindex=0x18ebb4) returned 0x0 [0161.126] CoGetContextToken (in: pToken=0x18dbcc | out: pToken=0x18dbcc) returned 0x0 [0161.126] CoGetContextToken (in: pToken=0x18dbac | out: pToken=0x18dbac) returned 0x0 [0161.126] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.126] WbemLocator:IUnknown:Release (This=0xff8160) returned 0x1 [0161.126] WbemLocator:IUnknown:Release (This=0xfbbe70) returned 0x0 [0161.127] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.127] IUnknown:Release (This=0x1002cd0) returned 0x2 [0161.127] IUnknown:Release (This=0x1002cd0) returned 0x1 [0161.127] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.127] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x1 [0161.127] WbemLocator:IUnknown:Release (This=0x1001338) returned 0x0 [0161.127] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.127] IUnknown:Release (This=0x100ed50) returned 0x2 [0161.127] IUnknown:Release (This=0x100ed50) returned 0x1 [0161.127] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.127] WbemLocator:IUnknown:Release (This=0xff8dc0) returned 0x1 [0161.127] WbemLocator:IUnknown:Release (This=0x1000d48) returned 0x0 [0161.127] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.127] IUnknown:Release (This=0x102dc80) returned 0x1 [0161.128] IUnknown:Release (This=0x102dc80) returned 0x0 [0161.128] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.128] IUnknown:Release (This=0x1033c98) returned 0x1 [0161.128] IUnknown:Release (This=0x1033c98) returned 0x0 [0161.128] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.128] IUnknown:Release (This=0x1033e30) returned 0x1 [0161.128] IUnknown:Release (This=0x1033e30) returned 0x0 [0161.128] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.128] IUnknown:Release (This=0x102ec70) returned 0x1 [0161.128] IUnknown:Release (This=0x102ec70) returned 0x0 [0161.128] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.128] IUnknown:Release (This=0x10339d0) returned 0x1 [0161.128] IUnknown:Release (This=0x10339d0) returned 0x0 [0161.128] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.128] WbemLocator:IUnknown:Release (This=0xff90c0) returned 0x1 [0161.128] WbemLocator:IUnknown:Release (This=0x103c148) returned 0x0 [0161.128] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.128] IUnknown:Release (This=0x1037128) returned 0x2 [0161.128] IUnknown:Release (This=0x1037128) returned 0x1 [0161.128] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.129] WbemLocator:IUnknown:Release (This=0xff9ec0) returned 0x1 [0161.129] WbemLocator:IUnknown:Release (This=0x103c328) returned 0x0 [0161.132] CoGetContextToken (in: pToken=0x18db30 | out: pToken=0x18db30) returned 0x0 [0161.132] IUnknown:Release (This=0x1054290) returned 0x2 [0161.132] IUnknown:Release (This=0x1054290) returned 0x1 [0161.134] CoGetContextToken (in: pToken=0x18ec68 | out: pToken=0x18ec68) returned 0x0 [0161.134] CoGetContextToken (in: pToken=0x18ebc8 | out: pToken=0x18ebc8) returned 0x0 [0161.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037600, riid=0x18ec98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ec94 | out: ppvObject=0x18ec94*=0x1037600) returned 0x0 [0161.134] WbemDefPath:IUnknown:AddRef (This=0x1037600) returned 0x3 [0161.134] WbemDefPath:IUnknown:Release (This=0x1037600) returned 0x2 [0161.134] WbemDefPath:IWbemPath:SetText (This=0x1037600, uMode=0x4, pszPath="Win32_OperatingSystem") returned 0x0 [0161.134] WbemDefPath:IWbemPath:GetInfo (in: This=0x1037600, uRequestedInfo=0x0, puResponse=0x18ee44 | out: puResponse=0x18ee44*=0xc15) returned 0x0 [0161.134] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1037600, puCount=0x18ee3c | out: puCount=0x18ee3c*=0x0) returned 0x0 [0161.135] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee14 | out: puCount=0x18ee14*=0x2) returned 0x0 [0161.135] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee10*=0x0, pszText=0x0 | out: puBuffLength=0x18ee10*=0xf, pszText=0x0) returned 0x0 [0161.135] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee10*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee10*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.145] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ecac*=0x674, lpdwindex=0x18eb5c | out: lpdwindex=0x18eb5c) returned 0x0 [0161.145] CoGetContextToken (in: pToken=0x18db74 | out: pToken=0x18db74) returned 0x0 [0161.145] CoGetContextToken (in: pToken=0x18db2c | out: pToken=0x18db2c) returned 0x0 [0161.145] WbemLocator:IUnknown:Release (This=0xffa6c0) returned 0x1 [0161.145] IUnknown:Release (This=0x1010bc0) returned 0x0 [0161.156] CoGetContextToken (in: pToken=0x18db74 | out: pToken=0x18db74) returned 0x0 [0161.156] CoGetContextToken (in: pToken=0x18db2c | out: pToken=0x18db2c) returned 0x0 [0161.156] WbemLocator:IUnknown:Release (This=0xff8fc0) returned 0x1 [0161.156] IUnknown:Release (This=0x1010328) returned 0x0 [0161.184] CoGetContextToken (in: pToken=0x18db74 | out: pToken=0x18db74) returned 0x0 [0161.184] CoGetContextToken (in: pToken=0x18db2c | out: pToken=0x18db2c) returned 0x0 [0161.184] WbemLocator:IUnknown:Release (This=0xffa4c0) returned 0x1 [0161.184] IUnknown:Release (This=0xffea78) returned 0x0 [0161.197] CoGetContextToken (in: pToken=0x18db74 | out: pToken=0x18db74) returned 0x0 [0161.197] CoGetContextToken (in: pToken=0x18db2c | out: pToken=0x18db2c) returned 0x0 [0161.197] WbemLocator:IUnknown:Release (This=0xffa0c0) returned 0x1 [0161.197] IUnknown:Release (This=0xfdc7d8) returned 0x0 [0161.221] CoGetContextToken (in: pToken=0x18ea70 | out: pToken=0x18ea70) returned 0x0 [0161.221] CoGetContextToken (in: pToken=0x18ea18 | out: pToken=0x18ea18) returned 0x0 [0161.221] IUnknown:QueryInterface (in: This=0xfb21f0, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9f4 | out: ppvObject=0x18e9f4*=0xfb2200) returned 0x0 [0161.222] CObjectContext::ContextCallback () returned 0x0 [0161.224] IUnknown:Release (This=0xfb2200) returned 0x1 [0161.224] CoUnmarshalInterface (in: pStm=0xff2900, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ea64 | out: ppv=0x18ea64*=0xff90c0) returned 0x0 [0161.224] CoMarshalInterface (pStm=0xff2900, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff90c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0161.225] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e904 | out: ppvObject=0x18e904*=0xff90c0) returned 0x0 [0161.225] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e8c0 | out: ppvObject=0x18e8c0*=0x0) returned 0x80004002 [0161.225] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e6dc | out: ppvObject=0x18e6dc*=0x0) returned 0x80004002 [0161.226] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e4b4 | out: ppvObject=0x18e4b4*=0x0) returned 0x80004002 [0161.227] WbemLocator:IUnknown:AddRef (This=0xff90c0) returned 0x3 [0161.227] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e214 | out: ppvObject=0x18e214*=0x0) returned 0x80004002 [0161.227] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e1c4 | out: ppvObject=0x18e1c4*=0x0) returned 0x80004002 [0161.227] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1d0 | out: ppvObject=0x18e1d0*=0xff901c) returned 0x0 [0161.227] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff901c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e1d8 | out: pCid=0x18e1d8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.227] WbemLocator:IUnknown:Release (This=0xff901c) returned 0x3 [0161.227] CoGetContextToken (in: pToken=0x18e230 | out: pToken=0x18e230) returned 0x0 [0161.227] CoGetObjectContext (in: riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x10530dc | out: ppv=0x10530dc*=0xfb2138) returned 0x0 [0161.227] CoGetContextToken (in: pToken=0x18e638 | out: pToken=0x18e638) returned 0x0 [0161.227] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6c4 | out: ppvObject=0x18e6c4*=0xff90a4) returned 0x0 [0161.227] WbemLocator:IRpcOptions:Query (in: This=0xff90a4, pPrx=0xff90c0, dwProperty=2, pdwValue=0x18e6d0 | out: pdwValue=0x18e6d0) returned 0x0 [0161.227] WbemLocator:IUnknown:Release (This=0xff90a4) returned 0x3 [0161.228] WbemLocator:IUnknown:Release (This=0xff90c0) returned 0x2 [0161.228] WbemLocator:IUnknown:Release (This=0xff90c0) returned 0x1 [0161.228] CoGetContextToken (in: pToken=0x18e9b0 | out: pToken=0x18e9b0) returned 0x0 [0161.228] WbemLocator:IUnknown:AddRef (This=0xff90c0) returned 0x2 [0161.228] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xff909c) returned 0x0 [0161.228] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff909c, pProxy=0xff90c0, pAuthnSvc=0x18ecb4, pAuthzSvc=0x18ecb0, pServerPrincName=0x18eca8, pAuthnLevel=0x18ecac, pImpLevel=0x18ec9c, pAuthInfo=0x18eca0, pCapabilites=0x18eca4 | out: pAuthnSvc=0x18ecb4*=0xa, pAuthzSvc=0x18ecb0*=0x0, pServerPrincName=0x18eca8, pAuthnLevel=0x18ecac*=0x6, pImpLevel=0x18ec9c*=0x2, pAuthInfo=0x18eca0, pCapabilites=0x18eca4*=0x1) returned 0x0 [0161.228] WbemLocator:IUnknown:Release (This=0xff909c) returned 0x2 [0161.228] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec58 | out: ppvObject=0x18ec58*=0xff90c0) returned 0x0 [0161.228] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec44 | out: ppvObject=0x18ec44*=0xff909c) returned 0x0 [0161.228] WbemLocator:IClientSecurity:SetBlanket (This=0xff909c, pProxy=0xff90c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.229] WbemLocator:IUnknown:Release (This=0xff909c) returned 0x3 [0161.229] WbemLocator:IUnknown:Release (This=0xff90c0) returned 0x2 [0161.229] CoTaskMemFree (pv=0x1057388) [0161.229] WbemLocator:IUnknown:Release (This=0xff90c0) returned 0x1 [0161.229] SysStringLen (param_1=0x0) returned 0x0 [0161.229] CoGetContextToken (in: pToken=0x18ec20 | out: pToken=0x18ec20) returned 0x0 [0161.229] CoGetContextToken (in: pToken=0x18eb80 | out: pToken=0x18eb80) returned 0x0 [0161.229] WbemLocator:IUnknown:QueryInterface (in: This=0xff90c0, riid=0x18ec50*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18ec4c | out: ppvObject=0x18ec4c*=0x103c148) returned 0x0 [0161.230] WbemLocator:IUnknown:AddRef (This=0x103c148) returned 0x3 [0161.230] WbemLocator:IUnknown:Release (This=0x103c148) returned 0x2 [0161.230] CoGetContextToken (in: pToken=0x18ebe0 | out: pToken=0x18ebe0) returned 0x0 [0161.230] WbemLocator:IUnknown:AddRef (This=0x103c148) returned 0x3 [0161.230] WbemLocator:IUnknown:QueryInterface (in: This=0x103c148, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0xff909c) returned 0x0 [0161.230] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff909c, pProxy=0x103c148, pAuthnSvc=0x18ecb4, pAuthzSvc=0x18ecb0, pServerPrincName=0x18eca8, pAuthnLevel=0x18ecac, pImpLevel=0x18ec9c, pAuthInfo=0x18eca0, pCapabilites=0x18eca4 | out: pAuthnSvc=0x18ecb4*=0xa, pAuthzSvc=0x18ecb0*=0x0, pServerPrincName=0x18eca8, pAuthnLevel=0x18ecac*=0x6, pImpLevel=0x18ec9c*=0x2, pAuthInfo=0x18eca0, pCapabilites=0x18eca4*=0x1) returned 0x0 [0161.231] WbemLocator:IUnknown:Release (This=0xff909c) returned 0x3 [0161.231] WbemLocator:IUnknown:QueryInterface (in: This=0x103c148, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec58 | out: ppvObject=0x18ec58*=0xff90c0) returned 0x0 [0161.231] WbemLocator:IUnknown:QueryInterface (in: This=0x103c148, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec44 | out: ppvObject=0x18ec44*=0xff909c) returned 0x0 [0161.231] WbemLocator:IClientSecurity:SetBlanket (This=0xff909c, pProxy=0x103c148, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.231] WbemLocator:IUnknown:Release (This=0xff909c) returned 0x4 [0161.231] WbemLocator:IUnknown:Release (This=0xff90c0) returned 0x3 [0161.231] CoTaskMemFree (pv=0x1057448) [0161.231] WbemLocator:IUnknown:Release (This=0x103c148) returned 0x2 [0161.231] SysStringLen (param_1=0x0) returned 0x0 [0161.232] CoGetContextToken (in: pToken=0x18eb58 | out: pToken=0x18eb58) returned 0x0 [0161.232] WbemLocator:IUnknown:AddRef (This=0x103c148) returned 0x3 [0161.232] IWbemServices:ExecQuery (in: This=0x103c148, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x18ed74 | out: ppEnum=0x18ed74*=0x1010a30) returned 0x0 [0161.354] IUnknown:QueryInterface (in: This=0x1010a30, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebc4 | out: ppvObject=0x18ebc4*=0x1010a34) returned 0x0 [0161.354] IClientSecurity:QueryBlanket (in: This=0x1010a34, pProxy=0x1010a30, pAuthnSvc=0x18ec14, pAuthzSvc=0x18ec10, pServerPrincName=0x18ec08, pAuthnLevel=0x18ec0c, pImpLevel=0x18ebfc, pAuthInfo=0x18ec00, pCapabilites=0x18ec04 | out: pAuthnSvc=0x18ec14*=0xa, pAuthzSvc=0x18ec10*=0x0, pServerPrincName=0x18ec08, pAuthnLevel=0x18ec0c*=0x6, pImpLevel=0x18ebfc*=0x2, pAuthInfo=0x18ec00, pCapabilites=0x18ec04*=0x1) returned 0x0 [0161.354] IUnknown:Release (This=0x1010a34) returned 0x1 [0161.354] IUnknown:QueryInterface (in: This=0x1010a30, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0xff9cc0) returned 0x0 [0161.355] IUnknown:QueryInterface (in: This=0x1010a30, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18eba4 | out: ppvObject=0x18eba4*=0x1010a34) returned 0x0 [0161.355] IClientSecurity:SetBlanket (This=0x1010a34, pProxy=0x1010a30, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.357] IUnknown:Release (This=0x1010a34) returned 0x2 [0161.357] WbemLocator:IUnknown:Release (This=0xff9cc0) returned 0x1 [0161.357] CoTaskMemFree (pv=0x1057568) [0161.357] IUnknown:QueryInterface (in: This=0x1010a30, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e7b0 | out: ppvObject=0x18e7b0*=0xff9cc0) returned 0x0 [0161.357] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e76c | out: ppvObject=0x18e76c*=0x0) returned 0x80004002 [0161.358] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e58c | out: ppvObject=0x18e58c*=0x0) returned 0x80004002 [0161.358] IUnknown:QueryInterface (in: This=0x1010a30, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e364 | out: ppvObject=0x18e364*=0x0) returned 0x80004002 [0161.359] WbemLocator:IUnknown:AddRef (This=0xff9cc0) returned 0x3 [0161.359] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e0c4 | out: ppvObject=0x18e0c4*=0x0) returned 0x80004002 [0161.359] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e074 | out: ppvObject=0x18e074*=0x0) returned 0x80004002 [0161.359] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e080 | out: ppvObject=0x18e080*=0xff9c1c) returned 0x0 [0161.359] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff9c1c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e088 | out: pCid=0x18e088*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.359] WbemLocator:IUnknown:Release (This=0xff9c1c) returned 0x3 [0161.359] CoGetContextToken (in: pToken=0x18e0e0 | out: pToken=0x18e0e0) returned 0x0 [0161.360] CoGetContextToken (in: pToken=0x18e4e8 | out: pToken=0x18e4e8) returned 0x0 [0161.360] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e574 | out: ppvObject=0x18e574*=0xff9ca4) returned 0x0 [0161.360] WbemLocator:IRpcOptions:Query (in: This=0xff9ca4, pPrx=0xff9cc0, dwProperty=2, pdwValue=0x18e580 | out: pdwValue=0x18e580) returned 0x80004002 [0161.360] WbemLocator:IUnknown:Release (This=0xff9ca4) returned 0x3 [0161.360] WbemLocator:IUnknown:Release (This=0xff9cc0) returned 0x2 [0161.360] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0161.360] CoGetContextToken (in: pToken=0x18ea20 | out: pToken=0x18ea20) returned 0x0 [0161.360] WbemLocator:IUnknown:QueryInterface (in: This=0xff9cc0, riid=0x18eaf0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18eaec | out: ppvObject=0x18eaec*=0x1010a30) returned 0x0 [0161.360] IUnknown:AddRef (This=0x1010a30) returned 0x4 [0161.360] IUnknown:Release (This=0x1010a30) returned 0x3 [0161.360] IUnknown:Release (This=0x1010a30) returned 0x2 [0161.360] WbemLocator:IUnknown:Release (This=0x103c148) returned 0x2 [0161.360] SysStringLen (param_1=0x0) returned 0x0 [0161.360] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18edc0 | out: puCount=0x18edc0*=0x2) returned 0x0 [0161.360] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edbc*=0x0, pszText=0x0 | out: puBuffLength=0x18edbc*=0xf, pszText=0x0) returned 0x0 [0161.360] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x18edbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.361] CoGetContextToken (in: pToken=0x18ec00 | out: pToken=0x18ec00) returned 0x0 [0161.361] IUnknown:AddRef (This=0x1010a30) returned 0x3 [0161.361] IEnumWbemClassObject:Clone (in: This=0x1010a30, ppEnum=0x18edbc | out: ppEnum=0x18edbc*=0x1010198) returned 0x0 [0161.362] IUnknown:QueryInterface (in: This=0x1010198, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec78 | out: ppvObject=0x18ec78*=0x101019c) returned 0x0 [0161.362] IClientSecurity:QueryBlanket (in: This=0x101019c, pProxy=0x1010198, pAuthnSvc=0x18ecc8, pAuthzSvc=0x18ecc4, pServerPrincName=0x18ecbc, pAuthnLevel=0x18ecc0, pImpLevel=0x18ecb0, pAuthInfo=0x18ecb4, pCapabilites=0x18ecb8 | out: pAuthnSvc=0x18ecc8*=0xa, pAuthzSvc=0x18ecc4*=0x0, pServerPrincName=0x18ecbc, pAuthnLevel=0x18ecc0*=0x6, pImpLevel=0x18ecb0*=0x2, pAuthInfo=0x18ecb4, pCapabilites=0x18ecb8*=0x1) returned 0x0 [0161.362] IUnknown:Release (This=0x101019c) returned 0x1 [0161.362] IUnknown:QueryInterface (in: This=0x1010198, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec6c | out: ppvObject=0x18ec6c*=0xffa0c0) returned 0x0 [0161.362] IUnknown:QueryInterface (in: This=0x1010198, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec58 | out: ppvObject=0x18ec58*=0x101019c) returned 0x0 [0161.362] IClientSecurity:SetBlanket (This=0x101019c, pProxy=0x1010198, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.385] IUnknown:Release (This=0x101019c) returned 0x2 [0161.385] WbemLocator:IUnknown:Release (This=0xffa0c0) returned 0x1 [0161.385] CoTaskMemFree (pv=0x1057418) [0161.385] IUnknown:QueryInterface (in: This=0x1010198, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e854 | out: ppvObject=0x18e854*=0xffa0c0) returned 0x0 [0161.386] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e810 | out: ppvObject=0x18e810*=0x0) returned 0x80004002 [0161.386] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e62c | out: ppvObject=0x18e62c*=0x0) returned 0x80004002 [0161.387] IUnknown:QueryInterface (in: This=0x1010198, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e404 | out: ppvObject=0x18e404*=0x0) returned 0x80004002 [0161.388] WbemLocator:IUnknown:AddRef (This=0xffa0c0) returned 0x3 [0161.388] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0161.388] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e114 | out: ppvObject=0x18e114*=0x0) returned 0x80004002 [0161.388] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e120 | out: ppvObject=0x18e120*=0xffa01c) returned 0x0 [0161.388] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xffa01c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e128 | out: pCid=0x18e128*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.388] WbemLocator:IUnknown:Release (This=0xffa01c) returned 0x3 [0161.388] CoGetContextToken (in: pToken=0x18e180 | out: pToken=0x18e180) returned 0x0 [0161.389] CoGetContextToken (in: pToken=0x18e588 | out: pToken=0x18e588) returned 0x0 [0161.389] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e614 | out: ppvObject=0x18e614*=0xffa0a4) returned 0x0 [0161.389] WbemLocator:IRpcOptions:Query (in: This=0xffa0a4, pPrx=0xffa0c0, dwProperty=2, pdwValue=0x18e620 | out: pdwValue=0x18e620) returned 0x80004002 [0161.389] WbemLocator:IUnknown:Release (This=0xffa0a4) returned 0x3 [0161.389] WbemLocator:IUnknown:Release (This=0xffa0c0) returned 0x2 [0161.389] CoGetContextToken (in: pToken=0x18eb68 | out: pToken=0x18eb68) returned 0x0 [0161.389] CoGetContextToken (in: pToken=0x18eac8 | out: pToken=0x18eac8) returned 0x0 [0161.389] WbemLocator:IUnknown:QueryInterface (in: This=0xffa0c0, riid=0x18eb98*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18eb94 | out: ppvObject=0x18eb94*=0x1010198) returned 0x0 [0161.389] IUnknown:AddRef (This=0x1010198) returned 0x4 [0161.389] IUnknown:Release (This=0x1010198) returned 0x3 [0161.389] IUnknown:Release (This=0x1010198) returned 0x2 [0161.389] IUnknown:Release (This=0x1010a30) returned 0x2 [0161.389] SysStringLen (param_1=0x0) returned 0x0 [0161.389] IEnumWbemClassObject:Reset (This=0x1010198) returned 0x0 [0161.390] CoTaskMemAlloc (cb=0x4) returned 0x100fd28 [0161.390] IEnumWbemClassObject:Next (in: This=0x1010198, lTimeout=-1, uCount=0x1, apObjects=0x100fd28, puReturned=0x2702c5c | out: apObjects=0x100fd28*=0x1053ab0, puReturned=0x2702c5c*=0x1) returned 0x0 [0161.397] IUnknown:QueryInterface (in: This=0x1053ab0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e418 | out: ppvObject=0x18e418*=0x1053ab0) returned 0x0 [0161.397] IUnknown:QueryInterface (in: This=0x1053ab0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e3d4 | out: ppvObject=0x18e3d4*=0x0) returned 0x80004002 [0161.397] IUnknown:QueryInterface (in: This=0x1053ab0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e1f4 | out: ppvObject=0x18e1f4*=0x0) returned 0x80004002 [0161.397] IUnknown:QueryInterface (in: This=0x1053ab0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dfcc | out: ppvObject=0x18dfcc*=0x0) returned 0x80004002 [0161.397] IUnknown:AddRef (This=0x1053ab0) returned 0x3 [0161.397] IUnknown:QueryInterface (in: This=0x1053ab0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dd2c | out: ppvObject=0x18dd2c*=0x0) returned 0x80004002 [0161.398] IUnknown:QueryInterface (in: This=0x1053ab0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dcdc | out: ppvObject=0x18dcdc*=0x0) returned 0x80004002 [0161.398] IUnknown:QueryInterface (in: This=0x1053ab0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dce8 | out: ppvObject=0x18dce8*=0x1053ab4) returned 0x0 [0161.398] IMarshal:GetUnmarshalClass (in: This=0x1053ab4, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dcf0 | out: pCid=0x18dcf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0161.398] IUnknown:Release (This=0x1053ab4) returned 0x3 [0161.398] CoGetContextToken (in: pToken=0x18dd48 | out: pToken=0x18dd48) returned 0x0 [0161.398] CoGetContextToken (in: pToken=0x18e150 | out: pToken=0x18e150) returned 0x0 [0161.398] IUnknown:QueryInterface (in: This=0x1053ab0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1dc | out: ppvObject=0x18e1dc*=0x0) returned 0x80004002 [0161.398] IUnknown:Release (This=0x1053ab0) returned 0x2 [0161.398] CoGetContextToken (in: pToken=0x18e728 | out: pToken=0x18e728) returned 0x0 [0161.398] CoGetContextToken (in: pToken=0x18e688 | out: pToken=0x18e688) returned 0x0 [0161.398] IUnknown:QueryInterface (in: This=0x1053ab0, riid=0x18e758*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e754 | out: ppvObject=0x18e754*=0x1053ab0) returned 0x0 [0161.398] IUnknown:AddRef (This=0x1053ab0) returned 0x4 [0161.398] IUnknown:Release (This=0x1053ab0) returned 0x3 [0161.398] IUnknown:Release (This=0x1053ab0) returned 0x2 [0161.398] CoTaskMemFree (pv=0x100fd28) [0161.398] CoGetContextToken (in: pToken=0x18ea98 | out: pToken=0x18ea98) returned 0x0 [0161.398] IUnknown:AddRef (This=0x1053ab0) returned 0x3 [0161.398] CoTaskMemAlloc (cb=0x4) returned 0x100fd28 [0161.399] IEnumWbemClassObject:Next (in: This=0x1010198, lTimeout=-1, uCount=0x1, apObjects=0x100fd28, puReturned=0x2702c5c | out: apObjects=0x100fd28*=0x0, puReturned=0x2702c5c*=0x0) returned 0x1 [0161.400] CoTaskMemFree (pv=0x100fd28) [0161.400] CoGetContextToken (in: pToken=0x18ec10 | out: pToken=0x18ec10) returned 0x0 [0161.400] IUnknown:AddRef (This=0x1010a30) returned 0x3 [0161.400] IEnumWbemClassObject:Clone (in: This=0x1010a30, ppEnum=0x18edcc | out: ppEnum=0x18edcc*=0x1010710) returned 0x0 [0161.401] IUnknown:QueryInterface (in: This=0x1010710, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec88 | out: ppvObject=0x18ec88*=0x1010714) returned 0x0 [0161.401] IClientSecurity:QueryBlanket (in: This=0x1010714, pProxy=0x1010710, pAuthnSvc=0x18ecd8, pAuthzSvc=0x18ecd4, pServerPrincName=0x18eccc, pAuthnLevel=0x18ecd0, pImpLevel=0x18ecc0, pAuthInfo=0x18ecc4, pCapabilites=0x18ecc8 | out: pAuthnSvc=0x18ecd8*=0xa, pAuthzSvc=0x18ecd4*=0x0, pServerPrincName=0x18eccc, pAuthnLevel=0x18ecd0*=0x6, pImpLevel=0x18ecc0*=0x2, pAuthInfo=0x18ecc4, pCapabilites=0x18ecc8*=0x1) returned 0x0 [0161.401] IUnknown:Release (This=0x1010714) returned 0x1 [0161.402] IUnknown:QueryInterface (in: This=0x1010710, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec7c | out: ppvObject=0x18ec7c*=0xffa5c0) returned 0x0 [0161.402] IUnknown:QueryInterface (in: This=0x1010710, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec68 | out: ppvObject=0x18ec68*=0x1010714) returned 0x0 [0161.402] IClientSecurity:SetBlanket (This=0x1010714, pProxy=0x1010710, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.404] IUnknown:Release (This=0x1010714) returned 0x2 [0161.404] WbemLocator:IUnknown:Release (This=0xffa5c0) returned 0x1 [0161.404] CoTaskMemFree (pv=0x1057628) [0161.404] IUnknown:QueryInterface (in: This=0x1010710, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e864 | out: ppvObject=0x18e864*=0xffa5c0) returned 0x0 [0161.405] WbemLocator:IUnknown:QueryInterface (in: This=0xffa5c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e820 | out: ppvObject=0x18e820*=0x0) returned 0x80004002 [0161.405] WbemLocator:IUnknown:QueryInterface (in: This=0xffa5c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e63c | out: ppvObject=0x18e63c*=0x0) returned 0x80004002 [0161.406] IUnknown:QueryInterface (in: This=0x1010710, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e414 | out: ppvObject=0x18e414*=0x0) returned 0x80004002 [0161.407] WbemLocator:IUnknown:AddRef (This=0xffa5c0) returned 0x3 [0161.407] WbemLocator:IUnknown:QueryInterface (in: This=0xffa5c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e174 | out: ppvObject=0x18e174*=0x0) returned 0x80004002 [0161.407] WbemLocator:IUnknown:QueryInterface (in: This=0xffa5c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e124 | out: ppvObject=0x18e124*=0x0) returned 0x80004002 [0161.407] WbemLocator:IUnknown:QueryInterface (in: This=0xffa5c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e130 | out: ppvObject=0x18e130*=0xffa51c) returned 0x0 [0161.407] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xffa51c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e138 | out: pCid=0x18e138*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.407] WbemLocator:IUnknown:Release (This=0xffa51c) returned 0x3 [0161.408] CoGetContextToken (in: pToken=0x18e190 | out: pToken=0x18e190) returned 0x0 [0161.408] CoGetContextToken (in: pToken=0x18e598 | out: pToken=0x18e598) returned 0x0 [0161.408] WbemLocator:IUnknown:QueryInterface (in: This=0xffa5c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e624 | out: ppvObject=0x18e624*=0xffa5a4) returned 0x0 [0161.408] WbemLocator:IRpcOptions:Query (in: This=0xffa5a4, pPrx=0xffa5c0, dwProperty=2, pdwValue=0x18e630 | out: pdwValue=0x18e630) returned 0x80004002 [0161.408] WbemLocator:IUnknown:Release (This=0xffa5a4) returned 0x3 [0161.408] WbemLocator:IUnknown:Release (This=0xffa5c0) returned 0x2 [0161.408] CoGetContextToken (in: pToken=0x18eb78 | out: pToken=0x18eb78) returned 0x0 [0161.408] CoGetContextToken (in: pToken=0x18ead8 | out: pToken=0x18ead8) returned 0x0 [0161.408] WbemLocator:IUnknown:QueryInterface (in: This=0xffa5c0, riid=0x18eba8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18eba4 | out: ppvObject=0x18eba4*=0x1010710) returned 0x0 [0161.408] IUnknown:AddRef (This=0x1010710) returned 0x4 [0161.408] IUnknown:Release (This=0x1010710) returned 0x3 [0161.408] IUnknown:Release (This=0x1010710) returned 0x2 [0161.408] IUnknown:Release (This=0x1010a30) returned 0x2 [0161.408] SysStringLen (param_1=0x0) returned 0x0 [0161.408] IEnumWbemClassObject:Reset (This=0x1010710) returned 0x0 [0161.409] CoTaskMemAlloc (cb=0x4) returned 0x100fc98 [0161.410] IEnumWbemClassObject:Next (in: This=0x1010710, lTimeout=-1, uCount=0x1, apObjects=0x100fc98, puReturned=0x2702d40 | out: apObjects=0x100fc98*=0x1053de0, puReturned=0x2702d40*=0x1) returned 0x0 [0161.416] IUnknown:QueryInterface (in: This=0x1053de0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e428 | out: ppvObject=0x18e428*=0x1053de0) returned 0x0 [0161.416] IUnknown:QueryInterface (in: This=0x1053de0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e3e4 | out: ppvObject=0x18e3e4*=0x0) returned 0x80004002 [0161.416] IUnknown:QueryInterface (in: This=0x1053de0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0161.416] IUnknown:QueryInterface (in: This=0x1053de0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0161.417] IUnknown:AddRef (This=0x1053de0) returned 0x3 [0161.417] IUnknown:QueryInterface (in: This=0x1053de0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dd3c | out: ppvObject=0x18dd3c*=0x0) returned 0x80004002 [0161.417] IUnknown:QueryInterface (in: This=0x1053de0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dcec | out: ppvObject=0x18dcec*=0x0) returned 0x80004002 [0161.417] IUnknown:QueryInterface (in: This=0x1053de0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dcf8 | out: ppvObject=0x18dcf8*=0x1053de4) returned 0x0 [0161.417] IMarshal:GetUnmarshalClass (in: This=0x1053de4, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd00 | out: pCid=0x18dd00*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0161.417] IUnknown:Release (This=0x1053de4) returned 0x3 [0161.417] CoGetContextToken (in: pToken=0x18dd58 | out: pToken=0x18dd58) returned 0x0 [0161.417] CoGetContextToken (in: pToken=0x18e160 | out: pToken=0x18e160) returned 0x0 [0161.417] IUnknown:QueryInterface (in: This=0x1053de0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1ec | out: ppvObject=0x18e1ec*=0x0) returned 0x80004002 [0161.417] IUnknown:Release (This=0x1053de0) returned 0x2 [0161.417] CoGetContextToken (in: pToken=0x18e738 | out: pToken=0x18e738) returned 0x0 [0161.417] CoGetContextToken (in: pToken=0x18e698 | out: pToken=0x18e698) returned 0x0 [0161.417] IUnknown:QueryInterface (in: This=0x1053de0, riid=0x18e768*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e764 | out: ppvObject=0x18e764*=0x1053de0) returned 0x0 [0161.417] IUnknown:AddRef (This=0x1053de0) returned 0x4 [0161.417] IUnknown:Release (This=0x1053de0) returned 0x3 [0161.417] IUnknown:Release (This=0x1053de0) returned 0x2 [0161.418] CoTaskMemFree (pv=0x100fc98) [0161.418] CoGetContextToken (in: pToken=0x18eaa8 | out: pToken=0x18eaa8) returned 0x0 [0161.418] IUnknown:AddRef (This=0x1053de0) returned 0x3 [0161.418] IWbemClassObject:Get (in: This=0x1053de0, wszName="__GENUS", lFlags=0, pVal=0x18edbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee3c*=0, plFlavor=0x18ee38*=0 | out: pVal=0x18edbc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ee3c*=3, plFlavor=0x18ee38*=64) returned 0x0 [0161.418] IWbemClassObject:Get (in: This=0x1053de0, wszName="__PATH", lFlags=0, pVal=0x18eda0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee24*=0, plFlavor=0x18ee20*=0 | out: pVal=0x18eda0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x18ee24*=8, plFlavor=0x18ee20*=64) returned 0x0 [0161.418] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0161.418] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0161.418] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x618 [0161.418] SetEvent (hEvent=0x30c) returned 1 [0161.419] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed78*=0x618, lpdwindex=0x18eb94 | out: lpdwindex=0x18eb94) returned 0x0 [0161.422] CoGetContextToken (in: pToken=0x18ec48 | out: pToken=0x18ec48) returned 0x0 [0161.422] CoGetContextToken (in: pToken=0x18eba8 | out: pToken=0x18eba8) returned 0x0 [0161.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037e50, riid=0x18ec78*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ec74 | out: ppvObject=0x18ec74*=0x1037e50) returned 0x0 [0161.422] WbemDefPath:IUnknown:AddRef (This=0x1037e50) returned 0x3 [0161.422] WbemDefPath:IUnknown:Release (This=0x1037e50) returned 0x2 [0161.422] WbemDefPath:IWbemPath:SetText (This=0x1037e50, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0161.422] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18edf8 | out: puCount=0x18edf8*=0x2) returned 0x0 [0161.422] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edf4*=0x0, pszText=0x0 | out: puBuffLength=0x18edf4*=0xf, pszText=0x0) returned 0x0 [0161.422] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edf4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18edf4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.422] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18edec | out: puCount=0x18edec*=0x2) returned 0x0 [0161.422] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ede8*=0x0, pszText=0x0 | out: puBuffLength=0x18ede8*=0xf, pszText=0x0) returned 0x0 [0161.422] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ede8*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ede8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.422] IWbemClassObject:Get (in: This=0x1053de0, wszName="Name", lFlags=0, pVal=0x18ede8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x270359c*=0, plFlavor=0x27035a0*=0 | out: pVal=0x18ede8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x270359c*=8, plFlavor=0x27035a0*=0) returned 0x0 [0161.422] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0161.423] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0161.423] IWbemClassObject:Get (in: This=0x1053de0, wszName="Name", lFlags=0, pVal=0x18edf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x270359c*=8, plFlavor=0x27035a0*=0 | out: pVal=0x18edf0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x270359c*=8, plFlavor=0x27035a0*=0) returned 0x0 [0161.423] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0161.423] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0161.523] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee40 | out: puCount=0x18ee40*=0x2) returned 0x0 [0161.523] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee3c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee3c*=0xf, pszText=0x0) returned 0x0 [0161.523] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.532] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ece8*=0x5fc, lpdwindex=0x18eb9c | out: lpdwindex=0x18eb9c) returned 0x0 [0161.561] CoGetContextToken (in: pToken=0x18eaa8 | out: pToken=0x18eaa8) returned 0x0 [0161.561] CoGetContextToken (in: pToken=0x18ea50 | out: pToken=0x18ea50) returned 0x0 [0161.561] IUnknown:QueryInterface (in: This=0xfb21f0, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea2c | out: ppvObject=0x18ea2c*=0xfb2200) returned 0x0 [0161.561] CObjectContext::ContextCallback () returned 0x0 [0161.563] IUnknown:Release (This=0xfb2200) returned 0x1 [0161.563] CoUnmarshalInterface (in: pStm=0xff2a60, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ea9c | out: ppv=0x18ea9c*=0xff95c0) returned 0x0 [0161.563] CoMarshalInterface (pStm=0xff2a60, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff95c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0161.564] WbemLocator:IUnknown:QueryInterface (in: This=0xff95c0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e93c | out: ppvObject=0x18e93c*=0xff95c0) returned 0x0 [0161.564] WbemLocator:IUnknown:QueryInterface (in: This=0xff95c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e8f8 | out: ppvObject=0x18e8f8*=0x0) returned 0x80004002 [0161.564] WbemLocator:IUnknown:QueryInterface (in: This=0xff95c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e714 | out: ppvObject=0x18e714*=0x0) returned 0x80004002 [0161.565] WbemLocator:IUnknown:QueryInterface (in: This=0xff95c0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e4ec | out: ppvObject=0x18e4ec*=0x0) returned 0x80004002 [0161.566] WbemLocator:IUnknown:AddRef (This=0xff95c0) returned 0x3 [0161.566] WbemLocator:IUnknown:QueryInterface (in: This=0xff95c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e24c | out: ppvObject=0x18e24c*=0x0) returned 0x80004002 [0161.566] WbemLocator:IUnknown:QueryInterface (in: This=0xff95c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e1fc | out: ppvObject=0x18e1fc*=0x0) returned 0x80004002 [0161.566] WbemLocator:IUnknown:QueryInterface (in: This=0xff95c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e208 | out: ppvObject=0x18e208*=0xff951c) returned 0x0 [0161.566] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff951c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e210 | out: pCid=0x18e210*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.566] WbemLocator:IUnknown:Release (This=0xff951c) returned 0x3 [0161.566] CoGetContextToken (in: pToken=0x18e268 | out: pToken=0x18e268) returned 0x0 [0161.566] CoGetContextToken (in: pToken=0x18e670 | out: pToken=0x18e670) returned 0x0 [0161.567] WbemLocator:IUnknown:QueryInterface (in: This=0xff95c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6fc | out: ppvObject=0x18e6fc*=0xff95a4) returned 0x0 [0161.567] WbemLocator:IRpcOptions:Query (in: This=0xff95a4, pPrx=0xff95c0, dwProperty=2, pdwValue=0x18e708 | out: pdwValue=0x18e708) returned 0x0 [0161.567] WbemLocator:IUnknown:Release (This=0xff95a4) returned 0x3 [0161.567] WbemLocator:IUnknown:Release (This=0xff95c0) returned 0x2 [0161.567] WbemLocator:IUnknown:Release (This=0xff95c0) returned 0x1 [0161.567] CoGetContextToken (in: pToken=0x18e9e8 | out: pToken=0x18e9e8) returned 0x0 [0161.567] WbemLocator:IUnknown:AddRef (This=0xff95c0) returned 0x2 [0161.567] WbemLocator:IUnknown:QueryInterface (in: This=0xff95c0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18eca0 | out: ppvObject=0x18eca0*=0xff959c) returned 0x0 [0161.568] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff959c, pProxy=0xff95c0, pAuthnSvc=0x18ecf0, pAuthzSvc=0x18ecec, pServerPrincName=0x18ece4, pAuthnLevel=0x18ece8, pImpLevel=0x18ecd8, pAuthInfo=0x18ecdc, pCapabilites=0x18ece0 | out: pAuthnSvc=0x18ecf0*=0xa, pAuthzSvc=0x18ecec*=0x0, pServerPrincName=0x18ece4, pAuthnLevel=0x18ece8*=0x6, pImpLevel=0x18ecd8*=0x2, pAuthInfo=0x18ecdc, pCapabilites=0x18ece0*=0x1) returned 0x0 [0161.568] WbemLocator:IUnknown:Release (This=0xff959c) returned 0x2 [0161.568] WbemLocator:IUnknown:QueryInterface (in: This=0xff95c0, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec94 | out: ppvObject=0x18ec94*=0xff95c0) returned 0x0 [0161.568] WbemLocator:IUnknown:QueryInterface (in: This=0xff95c0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec80 | out: ppvObject=0x18ec80*=0xff959c) returned 0x0 [0161.568] WbemLocator:IClientSecurity:SetBlanket (This=0xff959c, pProxy=0xff95c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.568] WbemLocator:IUnknown:Release (This=0xff959c) returned 0x3 [0161.568] WbemLocator:IUnknown:Release (This=0xff95c0) returned 0x2 [0161.568] CoTaskMemFree (pv=0x1057388) [0161.568] WbemLocator:IUnknown:Release (This=0xff95c0) returned 0x1 [0161.569] SysStringLen (param_1=0x0) returned 0x0 [0161.569] CoGetContextToken (in: pToken=0x18ec60 | out: pToken=0x18ec60) returned 0x0 [0161.569] CoGetContextToken (in: pToken=0x18ebc0 | out: pToken=0x18ebc0) returned 0x0 [0161.569] WbemLocator:IUnknown:QueryInterface (in: This=0xff95c0, riid=0x18ec90*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18ec8c | out: ppvObject=0x18ec8c*=0x103b568) returned 0x0 [0161.569] WbemLocator:IUnknown:AddRef (This=0x103b568) returned 0x3 [0161.569] WbemLocator:IUnknown:Release (This=0x103b568) returned 0x2 [0161.569] CoGetContextToken (in: pToken=0x18ec20 | out: pToken=0x18ec20) returned 0x0 [0161.570] WbemLocator:IUnknown:AddRef (This=0x103b568) returned 0x3 [0161.570] WbemLocator:IUnknown:QueryInterface (in: This=0x103b568, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18eca0 | out: ppvObject=0x18eca0*=0xff959c) returned 0x0 [0161.570] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff959c, pProxy=0x103b568, pAuthnSvc=0x18ecf0, pAuthzSvc=0x18ecec, pServerPrincName=0x18ece4, pAuthnLevel=0x18ece8, pImpLevel=0x18ecd8, pAuthInfo=0x18ecdc, pCapabilites=0x18ece0 | out: pAuthnSvc=0x18ecf0*=0xa, pAuthzSvc=0x18ecec*=0x0, pServerPrincName=0x18ece4, pAuthnLevel=0x18ece8*=0x6, pImpLevel=0x18ecd8*=0x2, pAuthInfo=0x18ecdc, pCapabilites=0x18ece0*=0x1) returned 0x0 [0161.570] WbemLocator:IUnknown:Release (This=0xff959c) returned 0x3 [0161.570] WbemLocator:IUnknown:QueryInterface (in: This=0x103b568, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec94 | out: ppvObject=0x18ec94*=0xff95c0) returned 0x0 [0161.570] WbemLocator:IUnknown:QueryInterface (in: This=0x103b568, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec80 | out: ppvObject=0x18ec80*=0xff959c) returned 0x0 [0161.570] WbemLocator:IClientSecurity:SetBlanket (This=0xff959c, pProxy=0x103b568, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.571] WbemLocator:IUnknown:Release (This=0xff959c) returned 0x4 [0161.571] WbemLocator:IUnknown:Release (This=0xff95c0) returned 0x3 [0161.571] CoTaskMemFree (pv=0x10575f8) [0161.571] WbemLocator:IUnknown:Release (This=0x103b568) returned 0x2 [0161.571] SysStringLen (param_1=0x0) returned 0x0 [0161.571] CoGetContextToken (in: pToken=0x18eba0 | out: pToken=0x18eba0) returned 0x0 [0161.571] WbemLocator:IUnknown:AddRef (This=0x103b568) returned 0x3 [0161.571] IWbemServices:ExecQuery (in: This=0x103b568, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x18edb0 | out: ppEnum=0x18edb0*=0x1010c88) returned 0x0 [0161.663] IUnknown:QueryInterface (in: This=0x1010c88, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec0c | out: ppvObject=0x18ec0c*=0x1010c8c) returned 0x0 [0161.663] IClientSecurity:QueryBlanket (in: This=0x1010c8c, pProxy=0x1010c88, pAuthnSvc=0x18ec5c, pAuthzSvc=0x18ec58, pServerPrincName=0x18ec50, pAuthnLevel=0x18ec54, pImpLevel=0x18ec44, pAuthInfo=0x18ec48, pCapabilites=0x18ec4c | out: pAuthnSvc=0x18ec5c*=0xa, pAuthzSvc=0x18ec58*=0x0, pServerPrincName=0x18ec50, pAuthnLevel=0x18ec54*=0x6, pImpLevel=0x18ec44*=0x2, pAuthInfo=0x18ec48, pCapabilites=0x18ec4c*=0x1) returned 0x0 [0161.663] IUnknown:Release (This=0x1010c8c) returned 0x1 [0161.663] IUnknown:QueryInterface (in: This=0x1010c88, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec00 | out: ppvObject=0x18ec00*=0xffa6c0) returned 0x0 [0161.663] IUnknown:QueryInterface (in: This=0x1010c88, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x1010c8c) returned 0x0 [0161.663] IClientSecurity:SetBlanket (This=0x1010c8c, pProxy=0x1010c88, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.665] IUnknown:Release (This=0x1010c8c) returned 0x2 [0161.666] WbemLocator:IUnknown:Release (This=0xffa6c0) returned 0x1 [0161.666] CoTaskMemFree (pv=0x1057658) [0161.666] IUnknown:QueryInterface (in: This=0x1010c88, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e7f8 | out: ppvObject=0x18e7f8*=0xffa6c0) returned 0x0 [0161.666] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e7b4 | out: ppvObject=0x18e7b4*=0x0) returned 0x80004002 [0161.667] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e5d4 | out: ppvObject=0x18e5d4*=0x0) returned 0x80004002 [0161.667] IUnknown:QueryInterface (in: This=0x1010c88, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e3ac | out: ppvObject=0x18e3ac*=0x0) returned 0x80004002 [0161.668] WbemLocator:IUnknown:AddRef (This=0xffa6c0) returned 0x3 [0161.668] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e10c | out: ppvObject=0x18e10c*=0x0) returned 0x80004002 [0161.668] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e0bc | out: ppvObject=0x18e0bc*=0x0) returned 0x80004002 [0161.668] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e0c8 | out: ppvObject=0x18e0c8*=0xffa61c) returned 0x0 [0161.668] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xffa61c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e0d0 | out: pCid=0x18e0d0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.668] WbemLocator:IUnknown:Release (This=0xffa61c) returned 0x3 [0161.668] CoGetContextToken (in: pToken=0x18e128 | out: pToken=0x18e128) returned 0x0 [0161.668] CoGetContextToken (in: pToken=0x18e530 | out: pToken=0x18e530) returned 0x0 [0161.668] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5bc | out: ppvObject=0x18e5bc*=0xffa6a4) returned 0x0 [0161.668] WbemLocator:IRpcOptions:Query (in: This=0xffa6a4, pPrx=0xffa6c0, dwProperty=2, pdwValue=0x18e5c8 | out: pdwValue=0x18e5c8) returned 0x80004002 [0161.668] WbemLocator:IUnknown:Release (This=0xffa6a4) returned 0x3 [0161.668] WbemLocator:IUnknown:Release (This=0xffa6c0) returned 0x2 [0161.669] CoGetContextToken (in: pToken=0x18eb08 | out: pToken=0x18eb08) returned 0x0 [0161.669] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0161.669] WbemLocator:IUnknown:QueryInterface (in: This=0xffa6c0, riid=0x18eb38*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18eb34 | out: ppvObject=0x18eb34*=0x1010c88) returned 0x0 [0161.669] IUnknown:AddRef (This=0x1010c88) returned 0x4 [0161.669] IUnknown:Release (This=0x1010c88) returned 0x3 [0161.669] IUnknown:Release (This=0x1010c88) returned 0x2 [0161.669] WbemLocator:IUnknown:Release (This=0x103b568) returned 0x2 [0161.669] SysStringLen (param_1=0x0) returned 0x0 [0161.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18edfc | out: puCount=0x18edfc*=0x2) returned 0x0 [0161.669] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edf8*=0x0, pszText=0x0 | out: puBuffLength=0x18edf8*=0xf, pszText=0x0) returned 0x0 [0161.669] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edf8*=0xf, pszText="00000000000000" | out: puBuffLength=0x18edf8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.669] CoGetContextToken (in: pToken=0x18ec20 | out: pToken=0x18ec20) returned 0x0 [0161.669] IUnknown:AddRef (This=0x1010c88) returned 0x3 [0161.669] IEnumWbemClassObject:Clone (in: This=0x1010c88, ppEnum=0x18ede0 | out: ppEnum=0x18ede0*=0x100ff40) returned 0x0 [0161.671] IUnknown:QueryInterface (in: This=0x100ff40, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec9c | out: ppvObject=0x18ec9c*=0x100ff44) returned 0x0 [0161.671] IClientSecurity:QueryBlanket (in: This=0x100ff44, pProxy=0x100ff40, pAuthnSvc=0x18ecec, pAuthzSvc=0x18ece8, pServerPrincName=0x18ece0, pAuthnLevel=0x18ece4, pImpLevel=0x18ecd4, pAuthInfo=0x18ecd8, pCapabilites=0x18ecdc | out: pAuthnSvc=0x18ecec*=0xa, pAuthzSvc=0x18ece8*=0x0, pServerPrincName=0x18ece0, pAuthnLevel=0x18ece4*=0x6, pImpLevel=0x18ecd4*=0x2, pAuthInfo=0x18ecd8, pCapabilites=0x18ecdc*=0x1) returned 0x0 [0161.671] IUnknown:Release (This=0x100ff44) returned 0x1 [0161.671] IUnknown:QueryInterface (in: This=0x100ff40, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec90 | out: ppvObject=0x18ec90*=0xff99c0) returned 0x0 [0161.671] IUnknown:QueryInterface (in: This=0x100ff40, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec7c | out: ppvObject=0x18ec7c*=0x100ff44) returned 0x0 [0161.671] IClientSecurity:SetBlanket (This=0x100ff44, pProxy=0x100ff40, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.774] IUnknown:Release (This=0x100ff44) returned 0x2 [0161.774] WbemLocator:IUnknown:Release (This=0xff99c0) returned 0x1 [0161.774] CoTaskMemFree (pv=0x1057628) [0161.774] IUnknown:QueryInterface (in: This=0x100ff40, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e878 | out: ppvObject=0x18e878*=0xff99c0) returned 0x0 [0161.774] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e834 | out: ppvObject=0x18e834*=0x0) returned 0x80004002 [0161.775] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e654 | out: ppvObject=0x18e654*=0x0) returned 0x80004002 [0161.816] IUnknown:QueryInterface (in: This=0x100ff40, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e42c | out: ppvObject=0x18e42c*=0x0) returned 0x80004002 [0161.819] WbemLocator:IUnknown:AddRef (This=0xff99c0) returned 0x3 [0161.819] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e18c | out: ppvObject=0x18e18c*=0x0) returned 0x80004002 [0161.819] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e13c | out: ppvObject=0x18e13c*=0x0) returned 0x80004002 [0161.819] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e148 | out: ppvObject=0x18e148*=0xff991c) returned 0x0 [0161.819] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff991c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e150 | out: pCid=0x18e150*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.819] WbemLocator:IUnknown:Release (This=0xff991c) returned 0x3 [0161.819] CoGetContextToken (in: pToken=0x18e1a8 | out: pToken=0x18e1a8) returned 0x0 [0161.819] CoGetContextToken (in: pToken=0x18e5b0 | out: pToken=0x18e5b0) returned 0x0 [0161.819] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e63c | out: ppvObject=0x18e63c*=0xff99a4) returned 0x0 [0161.820] WbemLocator:IRpcOptions:Query (in: This=0xff99a4, pPrx=0xff99c0, dwProperty=2, pdwValue=0x18e648 | out: pdwValue=0x18e648) returned 0x80004002 [0161.820] WbemLocator:IUnknown:Release (This=0xff99a4) returned 0x3 [0161.820] WbemLocator:IUnknown:Release (This=0xff99c0) returned 0x2 [0161.820] CoGetContextToken (in: pToken=0x18eb88 | out: pToken=0x18eb88) returned 0x0 [0161.820] CoGetContextToken (in: pToken=0x18eae8 | out: pToken=0x18eae8) returned 0x0 [0161.820] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x18ebb8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18ebb4 | out: ppvObject=0x18ebb4*=0x100ff40) returned 0x0 [0161.820] IUnknown:AddRef (This=0x100ff40) returned 0x4 [0161.820] IUnknown:Release (This=0x100ff40) returned 0x3 [0161.820] IUnknown:Release (This=0x100ff40) returned 0x2 [0161.820] IUnknown:Release (This=0x1010c88) returned 0x2 [0161.820] SysStringLen (param_1=0x0) returned 0x0 [0161.820] IEnumWbemClassObject:Reset (This=0x100ff40) returned 0x0 [0161.821] CoTaskMemAlloc (cb=0x4) returned 0x100fac8 [0161.822] IEnumWbemClassObject:Next (in: This=0x100ff40, lTimeout=-1, uCount=0x1, apObjects=0x100fac8, puReturned=0x2704284 | out: apObjects=0x100fac8*=0x1032510, puReturned=0x2704284*=0x1) returned 0x0 [0162.852] IUnknown:QueryInterface (in: This=0x1032510, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e440 | out: ppvObject=0x18e440*=0x1032510) returned 0x0 [0162.853] IUnknown:QueryInterface (in: This=0x1032510, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e3fc | out: ppvObject=0x18e3fc*=0x0) returned 0x80004002 [0162.853] IUnknown:QueryInterface (in: This=0x1032510, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e21c | out: ppvObject=0x18e21c*=0x0) returned 0x80004002 [0162.853] IUnknown:QueryInterface (in: This=0x1032510, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0162.853] IUnknown:AddRef (This=0x1032510) returned 0x3 [0162.853] IUnknown:QueryInterface (in: This=0x1032510, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dd54 | out: ppvObject=0x18dd54*=0x0) returned 0x80004002 [0162.853] IUnknown:QueryInterface (in: This=0x1032510, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd04 | out: ppvObject=0x18dd04*=0x0) returned 0x80004002 [0162.853] IUnknown:QueryInterface (in: This=0x1032510, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dd10 | out: ppvObject=0x18dd10*=0x1032514) returned 0x0 [0162.853] IMarshal:GetUnmarshalClass (in: This=0x1032514, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd18 | out: pCid=0x18dd18*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0162.853] IUnknown:Release (This=0x1032514) returned 0x3 [0162.853] CoGetContextToken (in: pToken=0x18dd70 | out: pToken=0x18dd70) returned 0x0 [0162.854] CoGetContextToken (in: pToken=0x18e178 | out: pToken=0x18e178) returned 0x0 [0162.854] IUnknown:QueryInterface (in: This=0x1032510, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0162.854] IUnknown:Release (This=0x1032510) returned 0x2 [0162.854] CoGetContextToken (in: pToken=0x18e750 | out: pToken=0x18e750) returned 0x0 [0162.854] CoGetContextToken (in: pToken=0x18e6b0 | out: pToken=0x18e6b0) returned 0x0 [0162.854] IUnknown:QueryInterface (in: This=0x1032510, riid=0x18e780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e77c | out: ppvObject=0x18e77c*=0x1032510) returned 0x0 [0162.854] IUnknown:AddRef (This=0x1032510) returned 0x4 [0162.854] IUnknown:Release (This=0x1032510) returned 0x3 [0162.854] IUnknown:Release (This=0x1032510) returned 0x2 [0162.854] CoTaskMemFree (pv=0x100fac8) [0162.854] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0162.854] IUnknown:AddRef (This=0x1032510) returned 0x3 [0162.854] IWbemClassObject:Get (in: This=0x1032510, wszName="__GENUS", lFlags=0, pVal=0x18edd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee50*=0, plFlavor=0x18ee4c*=0 | out: pVal=0x18edd0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ee50*=3, plFlavor=0x18ee4c*=64) returned 0x0 [0162.854] IWbemClassObject:Get (in: This=0x1032510, wszName="__PATH", lFlags=0, pVal=0x18edb4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee38*=0, plFlavor=0x18ee34*=0 | out: pVal=0x18edb4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x18ee38*=8, plFlavor=0x18ee34*=64) returned 0x0 [0162.855] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0162.855] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0162.855] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5f8 [0162.855] SetEvent (hEvent=0x30c) returned 1 [0162.855] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed8c*=0x5f8, lpdwindex=0x18ebac | out: lpdwindex=0x18ebac) returned 0x0 [0162.858] CoGetContextToken (in: pToken=0x18ec58 | out: pToken=0x18ec58) returned 0x0 [0162.858] CoGetContextToken (in: pToken=0x18ebb8 | out: pToken=0x18ebb8) returned 0x0 [0162.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038240, riid=0x18ec88*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ec84 | out: ppvObject=0x18ec84*=0x1038240) returned 0x0 [0162.858] WbemDefPath:IUnknown:AddRef (This=0x1038240) returned 0x3 [0162.858] WbemDefPath:IUnknown:Release (This=0x1038240) returned 0x2 [0162.858] WbemDefPath:IWbemPath:SetText (This=0x1038240, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0162.858] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee0c | out: puCount=0x18ee0c*=0x2) returned 0x0 [0162.858] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee08*=0x0, pszText=0x0 | out: puBuffLength=0x18ee08*=0xf, pszText=0x0) returned 0x0 [0162.858] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee08*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee08*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.858] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee04 | out: puCount=0x18ee04*=0x2) returned 0x0 [0162.858] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee00*=0x0, pszText=0x0 | out: puBuffLength=0x18ee00*=0xf, pszText=0x0) returned 0x0 [0162.858] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee00*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee00*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.858] IWbemClassObject:Get (in: This=0x1032510, wszName="Name", lFlags=0, pVal=0x18ee00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2704ad4*=0, plFlavor=0x2704ad8*=0 | out: pVal=0x18ee00*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x2704ad4*=8, plFlavor=0x2704ad8*=0) returned 0x0 [0162.858] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0162.858] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0162.858] IWbemClassObject:Get (in: This=0x1032510, wszName="Name", lFlags=0, pVal=0x18ee08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2704ad4*=8, plFlavor=0x2704ad8*=0 | out: pVal=0x18ee08*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x2704ad4*=8, plFlavor=0x2704ad8*=0) returned 0x0 [0162.858] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0162.858] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0162.859] CoGetContextToken (in: pToken=0x18ed00 | out: pToken=0x18ed00) returned 0x0 [0162.859] WbemLocator:IUnknown:Release (This=0xff99c0) returned 0x1 [0162.859] IUnknown:Release (This=0x100ff40) returned 0x0 [0162.864] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee40 | out: puCount=0x18ee40*=0x2) returned 0x0 [0162.864] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee3c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee3c*=0xf, pszText=0x0) returned 0x0 [0162.864] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee3c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee3c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.886] GlobalMemoryStatusEx (in: lpBuffer=0x2704cc4 | out: lpBuffer=0x2704cc4) returned 1 [0162.931] GetUserNameW (in: lpBuffer=0x18ec58, pcbBuffer=0x27059b4 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x27059b4) returned 1 [0162.932] GetComputerNameW (in: lpBuffer=0x18ec58, nSize=0x2705e20 | out: lpBuffer="XC64ZB", nSize=0x2705e20) returned 1 [0162.932] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee3c | out: puCount=0x18ee3c*=0x2) returned 0x0 [0162.932] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee38*=0x0, pszText=0x0 | out: puBuffLength=0x18ee38*=0xf, pszText=0x0) returned 0x0 [0162.932] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee38*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee38*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.932] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5e4 [0162.932] SetEvent (hEvent=0x30c) returned 1 [0162.932] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed94*=0x5e4, lpdwindex=0x18ebb4 | out: lpdwindex=0x18ebb4) returned 0x0 [0162.935] CoGetContextToken (in: pToken=0x18ec60 | out: pToken=0x18ec60) returned 0x0 [0162.935] CoGetContextToken (in: pToken=0x18ebc0 | out: pToken=0x18ebc0) returned 0x0 [0162.935] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037bb0, riid=0x18ec90*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ec8c | out: ppvObject=0x18ec8c*=0x1037bb0) returned 0x0 [0162.935] WbemDefPath:IUnknown:AddRef (This=0x1037bb0) returned 0x3 [0162.935] WbemDefPath:IUnknown:Release (This=0x1037bb0) returned 0x2 [0162.935] WbemDefPath:IWbemPath:SetText (This=0x1037bb0, uMode=0x4, pszPath="Win32_OperatingSystem") returned 0x0 [0162.935] WbemDefPath:IWbemPath:GetInfo (in: This=0x1037bb0, uRequestedInfo=0x0, puResponse=0x18ee40 | out: puResponse=0x18ee40*=0xc15) returned 0x0 [0162.935] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1037bb0, puCount=0x18ee38 | out: puCount=0x18ee38*=0x0) returned 0x0 [0162.935] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee10 | out: puCount=0x18ee10*=0x2) returned 0x0 [0162.935] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee0c*=0x0, pszText=0x0 | out: puBuffLength=0x18ee0c*=0xf, pszText=0x0) returned 0x0 [0162.936] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.946] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18eca8*=0x444, lpdwindex=0x18eb5c | out: lpdwindex=0x18eb5c) returned 0x0 [0162.974] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0162.974] CoGetContextToken (in: pToken=0x18ea10 | out: pToken=0x18ea10) returned 0x0 [0162.974] IUnknown:QueryInterface (in: This=0xfb21f0, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9ec | out: ppvObject=0x18e9ec*=0xfb2200) returned 0x0 [0162.974] CObjectContext::ContextCallback () returned 0x0 [0162.976] IUnknown:Release (This=0xfb2200) returned 0x1 [0162.976] CoUnmarshalInterface (in: pStm=0xff2a80, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ea5c | out: ppv=0x18ea5c*=0xffa8c0) returned 0x0 [0162.976] CoMarshalInterface (pStm=0xff2a80, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xffa8c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0162.976] WbemLocator:IUnknown:QueryInterface (in: This=0xffa8c0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8fc | out: ppvObject=0x18e8fc*=0xffa8c0) returned 0x0 [0162.977] WbemLocator:IUnknown:QueryInterface (in: This=0xffa8c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e8b8 | out: ppvObject=0x18e8b8*=0x0) returned 0x80004002 [0162.977] WbemLocator:IUnknown:QueryInterface (in: This=0xffa8c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e6d4 | out: ppvObject=0x18e6d4*=0x0) returned 0x80004002 [0162.977] WbemLocator:IUnknown:QueryInterface (in: This=0xffa8c0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x0) returned 0x80004002 [0162.978] WbemLocator:IUnknown:AddRef (This=0xffa8c0) returned 0x3 [0162.978] WbemLocator:IUnknown:QueryInterface (in: This=0xffa8c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e20c | out: ppvObject=0x18e20c*=0x0) returned 0x80004002 [0162.978] WbemLocator:IUnknown:QueryInterface (in: This=0xffa8c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e1bc | out: ppvObject=0x18e1bc*=0x0) returned 0x80004002 [0162.978] WbemLocator:IUnknown:QueryInterface (in: This=0xffa8c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1c8 | out: ppvObject=0x18e1c8*=0xffa81c) returned 0x0 [0162.978] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xffa81c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e1d0 | out: pCid=0x18e1d0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.978] WbemLocator:IUnknown:Release (This=0xffa81c) returned 0x3 [0162.978] CoGetContextToken (in: pToken=0x18e228 | out: pToken=0x18e228) returned 0x0 [0162.978] CoGetContextToken (in: pToken=0x18e630 | out: pToken=0x18e630) returned 0x0 [0162.978] WbemLocator:IUnknown:QueryInterface (in: This=0xffa8c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6bc | out: ppvObject=0x18e6bc*=0xffa8a4) returned 0x0 [0162.978] WbemLocator:IRpcOptions:Query (in: This=0xffa8a4, pPrx=0xffa8c0, dwProperty=2, pdwValue=0x18e6c8 | out: pdwValue=0x18e6c8) returned 0x0 [0162.978] WbemLocator:IUnknown:Release (This=0xffa8a4) returned 0x3 [0162.979] WbemLocator:IUnknown:Release (This=0xffa8c0) returned 0x2 [0162.979] WbemLocator:IUnknown:Release (This=0xffa8c0) returned 0x1 [0162.979] CoGetContextToken (in: pToken=0x18e9a8 | out: pToken=0x18e9a8) returned 0x0 [0162.979] WbemLocator:IUnknown:AddRef (This=0xffa8c0) returned 0x2 [0162.979] WbemLocator:IUnknown:QueryInterface (in: This=0xffa8c0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec60 | out: ppvObject=0x18ec60*=0xffa89c) returned 0x0 [0162.979] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xffa89c, pProxy=0xffa8c0, pAuthnSvc=0x18ecb0, pAuthzSvc=0x18ecac, pServerPrincName=0x18eca4, pAuthnLevel=0x18eca8, pImpLevel=0x18ec98, pAuthInfo=0x18ec9c, pCapabilites=0x18eca0 | out: pAuthnSvc=0x18ecb0*=0xa, pAuthzSvc=0x18ecac*=0x0, pServerPrincName=0x18eca4, pAuthnLevel=0x18eca8*=0x6, pImpLevel=0x18ec98*=0x2, pAuthInfo=0x18ec9c, pCapabilites=0x18eca0*=0x1) returned 0x0 [0162.979] WbemLocator:IUnknown:Release (This=0xffa89c) returned 0x2 [0162.979] WbemLocator:IUnknown:QueryInterface (in: This=0xffa8c0, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec54 | out: ppvObject=0x18ec54*=0xffa8c0) returned 0x0 [0162.979] WbemLocator:IUnknown:QueryInterface (in: This=0xffa8c0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec40 | out: ppvObject=0x18ec40*=0xffa89c) returned 0x0 [0162.979] WbemLocator:IClientSecurity:SetBlanket (This=0xffa89c, pProxy=0xffa8c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0162.980] WbemLocator:IUnknown:Release (This=0xffa89c) returned 0x3 [0162.980] WbemLocator:IUnknown:Release (This=0xffa8c0) returned 0x2 [0162.980] CoTaskMemFree (pv=0x1057628) [0162.980] WbemLocator:IUnknown:Release (This=0xffa8c0) returned 0x1 [0162.980] SysStringLen (param_1=0x0) returned 0x0 [0162.980] CoGetContextToken (in: pToken=0x18ec20 | out: pToken=0x18ec20) returned 0x0 [0162.980] CoGetContextToken (in: pToken=0x18eb80 | out: pToken=0x18eb80) returned 0x0 [0162.980] WbemLocator:IUnknown:QueryInterface (in: This=0xffa8c0, riid=0x18ec50*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18ec4c | out: ppvObject=0x18ec4c*=0x103bd88) returned 0x0 [0162.980] WbemLocator:IUnknown:AddRef (This=0x103bd88) returned 0x3 [0162.981] WbemLocator:IUnknown:Release (This=0x103bd88) returned 0x2 [0162.981] CoGetContextToken (in: pToken=0x18ebe0 | out: pToken=0x18ebe0) returned 0x0 [0162.981] WbemLocator:IUnknown:AddRef (This=0x103bd88) returned 0x3 [0162.981] WbemLocator:IUnknown:QueryInterface (in: This=0x103bd88, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec60 | out: ppvObject=0x18ec60*=0xffa89c) returned 0x0 [0162.981] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xffa89c, pProxy=0x103bd88, pAuthnSvc=0x18ecb0, pAuthzSvc=0x18ecac, pServerPrincName=0x18eca4, pAuthnLevel=0x18eca8, pImpLevel=0x18ec98, pAuthInfo=0x18ec9c, pCapabilites=0x18eca0 | out: pAuthnSvc=0x18ecb0*=0xa, pAuthzSvc=0x18ecac*=0x0, pServerPrincName=0x18eca4, pAuthnLevel=0x18eca8*=0x6, pImpLevel=0x18ec98*=0x2, pAuthInfo=0x18ec9c, pCapabilites=0x18eca0*=0x1) returned 0x0 [0162.981] WbemLocator:IUnknown:Release (This=0xffa89c) returned 0x3 [0162.981] WbemLocator:IUnknown:QueryInterface (in: This=0x103bd88, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec54 | out: ppvObject=0x18ec54*=0xffa8c0) returned 0x0 [0162.981] WbemLocator:IUnknown:QueryInterface (in: This=0x103bd88, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec40 | out: ppvObject=0x18ec40*=0xffa89c) returned 0x0 [0162.981] WbemLocator:IClientSecurity:SetBlanket (This=0xffa89c, pProxy=0x103bd88, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0162.981] WbemLocator:IUnknown:Release (This=0xffa89c) returned 0x4 [0162.981] WbemLocator:IUnknown:Release (This=0xffa8c0) returned 0x3 [0162.981] CoTaskMemFree (pv=0x1057658) [0162.982] WbemLocator:IUnknown:Release (This=0x103bd88) returned 0x2 [0162.982] SysStringLen (param_1=0x0) returned 0x0 [0162.982] CoGetContextToken (in: pToken=0x18eb58 | out: pToken=0x18eb58) returned 0x0 [0162.982] WbemLocator:IUnknown:AddRef (This=0x103bd88) returned 0x3 [0162.982] IWbemServices:ExecQuery (in: This=0x103bd88, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x18ed70 | out: ppEnum=0x18ed70*=0x10107d8) returned 0x0 [0163.066] IUnknown:QueryInterface (in: This=0x10107d8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebc0 | out: ppvObject=0x18ebc0*=0x10107dc) returned 0x0 [0163.067] IClientSecurity:QueryBlanket (in: This=0x10107dc, pProxy=0x10107d8, pAuthnSvc=0x18ec10, pAuthzSvc=0x18ec0c, pServerPrincName=0x18ec04, pAuthnLevel=0x18ec08, pImpLevel=0x18ebf8, pAuthInfo=0x18ebfc, pCapabilites=0x18ec00 | out: pAuthnSvc=0x18ec10*=0xa, pAuthzSvc=0x18ec0c*=0x0, pServerPrincName=0x18ec04, pAuthnLevel=0x18ec08*=0x6, pImpLevel=0x18ebf8*=0x2, pAuthInfo=0x18ebfc, pCapabilites=0x18ec00*=0x1) returned 0x0 [0163.067] IUnknown:Release (This=0x10107dc) returned 0x1 [0163.067] IUnknown:QueryInterface (in: This=0x10107d8, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebb4 | out: ppvObject=0x18ebb4*=0xffa9c0) returned 0x0 [0163.067] IUnknown:QueryInterface (in: This=0x10107d8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18eba0 | out: ppvObject=0x18eba0*=0x10107dc) returned 0x0 [0163.067] IClientSecurity:SetBlanket (This=0x10107dc, pProxy=0x10107d8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0163.069] IUnknown:Release (This=0x10107dc) returned 0x2 [0163.069] WbemLocator:IUnknown:Release (This=0xffa9c0) returned 0x1 [0163.069] CoTaskMemFree (pv=0x1057388) [0163.069] IUnknown:QueryInterface (in: This=0x10107d8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e7ac | out: ppvObject=0x18e7ac*=0xffa9c0) returned 0x0 [0163.069] WbemLocator:IUnknown:QueryInterface (in: This=0xffa9c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e768 | out: ppvObject=0x18e768*=0x0) returned 0x80004002 [0163.070] WbemLocator:IUnknown:QueryInterface (in: This=0xffa9c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x0) returned 0x80004002 [0163.070] IUnknown:QueryInterface (in: This=0x10107d8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e35c | out: ppvObject=0x18e35c*=0x0) returned 0x80004002 [0163.071] WbemLocator:IUnknown:AddRef (This=0xffa9c0) returned 0x3 [0163.071] WbemLocator:IUnknown:QueryInterface (in: This=0xffa9c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e0bc | out: ppvObject=0x18e0bc*=0x0) returned 0x80004002 [0163.071] WbemLocator:IUnknown:QueryInterface (in: This=0xffa9c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e06c | out: ppvObject=0x18e06c*=0x0) returned 0x80004002 [0163.071] WbemLocator:IUnknown:QueryInterface (in: This=0xffa9c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e078 | out: ppvObject=0x18e078*=0xffa91c) returned 0x0 [0163.071] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xffa91c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e080 | out: pCid=0x18e080*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.071] WbemLocator:IUnknown:Release (This=0xffa91c) returned 0x3 [0163.071] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0163.072] CoGetContextToken (in: pToken=0x18e4e0 | out: pToken=0x18e4e0) returned 0x0 [0163.072] WbemLocator:IUnknown:QueryInterface (in: This=0xffa9c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e56c | out: ppvObject=0x18e56c*=0xffa9a4) returned 0x0 [0163.072] WbemLocator:IRpcOptions:Query (in: This=0xffa9a4, pPrx=0xffa9c0, dwProperty=2, pdwValue=0x18e578 | out: pdwValue=0x18e578) returned 0x80004002 [0163.072] WbemLocator:IUnknown:Release (This=0xffa9a4) returned 0x3 [0163.072] WbemLocator:IUnknown:Release (This=0xffa9c0) returned 0x2 [0163.072] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0163.072] CoGetContextToken (in: pToken=0x18ea20 | out: pToken=0x18ea20) returned 0x0 [0163.072] WbemLocator:IUnknown:QueryInterface (in: This=0xffa9c0, riid=0x18eaf0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18eaec | out: ppvObject=0x18eaec*=0x10107d8) returned 0x0 [0163.072] IUnknown:AddRef (This=0x10107d8) returned 0x4 [0163.072] IUnknown:Release (This=0x10107d8) returned 0x3 [0163.072] IUnknown:Release (This=0x10107d8) returned 0x2 [0163.072] WbemLocator:IUnknown:Release (This=0x103bd88) returned 0x2 [0163.072] SysStringLen (param_1=0x0) returned 0x0 [0163.072] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18edbc | out: puCount=0x18edbc*=0x2) returned 0x0 [0163.072] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edb8*=0x0, pszText=0x0 | out: puBuffLength=0x18edb8*=0xf, pszText=0x0) returned 0x0 [0163.072] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edb8*=0xf, pszText="00000000000000" | out: puBuffLength=0x18edb8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.072] CoGetContextToken (in: pToken=0x18ebf8 | out: pToken=0x18ebf8) returned 0x0 [0163.073] IUnknown:AddRef (This=0x10107d8) returned 0x3 [0163.073] IEnumWbemClassObject:Clone (in: This=0x10107d8, ppEnum=0x18edb8 | out: ppEnum=0x18edb8*=0x1010580) returned 0x0 [0163.074] IUnknown:QueryInterface (in: This=0x1010580, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec74 | out: ppvObject=0x18ec74*=0x1010584) returned 0x0 [0163.074] IClientSecurity:QueryBlanket (in: This=0x1010584, pProxy=0x1010580, pAuthnSvc=0x18ecc4, pAuthzSvc=0x18ecc0, pServerPrincName=0x18ecb8, pAuthnLevel=0x18ecbc, pImpLevel=0x18ecac, pAuthInfo=0x18ecb0, pCapabilites=0x18ecb4 | out: pAuthnSvc=0x18ecc4*=0xa, pAuthzSvc=0x18ecc0*=0x0, pServerPrincName=0x18ecb8, pAuthnLevel=0x18ecbc*=0x6, pImpLevel=0x18ecac*=0x2, pAuthInfo=0x18ecb0, pCapabilites=0x18ecb4*=0x1) returned 0x0 [0163.074] IUnknown:Release (This=0x1010584) returned 0x1 [0163.074] IUnknown:QueryInterface (in: This=0x1010580, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec68 | out: ppvObject=0x18ec68*=0xff92c0) returned 0x0 [0163.074] IUnknown:QueryInterface (in: This=0x1010580, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec54 | out: ppvObject=0x18ec54*=0x1010584) returned 0x0 [0163.074] IClientSecurity:SetBlanket (This=0x1010584, pProxy=0x1010580, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0163.076] IUnknown:Release (This=0x1010584) returned 0x2 [0163.076] WbemLocator:IUnknown:Release (This=0xff92c0) returned 0x1 [0163.076] CoTaskMemFree (pv=0x1057598) [0163.076] IUnknown:QueryInterface (in: This=0x1010580, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e850 | out: ppvObject=0x18e850*=0xff92c0) returned 0x0 [0163.077] WbemLocator:IUnknown:QueryInterface (in: This=0xff92c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e80c | out: ppvObject=0x18e80c*=0x0) returned 0x80004002 [0163.079] WbemLocator:IUnknown:QueryInterface (in: This=0xff92c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e62c | out: ppvObject=0x18e62c*=0x0) returned 0x80004002 [0163.079] IUnknown:QueryInterface (in: This=0x1010580, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e404 | out: ppvObject=0x18e404*=0x0) returned 0x80004002 [0163.080] WbemLocator:IUnknown:AddRef (This=0xff92c0) returned 0x3 [0163.080] WbemLocator:IUnknown:QueryInterface (in: This=0xff92c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0163.080] WbemLocator:IUnknown:QueryInterface (in: This=0xff92c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e114 | out: ppvObject=0x18e114*=0x0) returned 0x80004002 [0163.080] WbemLocator:IUnknown:QueryInterface (in: This=0xff92c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e120 | out: ppvObject=0x18e120*=0xff921c) returned 0x0 [0163.081] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff921c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e128 | out: pCid=0x18e128*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.081] WbemLocator:IUnknown:Release (This=0xff921c) returned 0x3 [0163.081] CoGetContextToken (in: pToken=0x18e180 | out: pToken=0x18e180) returned 0x0 [0163.081] CoGetContextToken (in: pToken=0x18e588 | out: pToken=0x18e588) returned 0x0 [0163.081] WbemLocator:IUnknown:QueryInterface (in: This=0xff92c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e614 | out: ppvObject=0x18e614*=0xff92a4) returned 0x0 [0163.081] WbemLocator:IRpcOptions:Query (in: This=0xff92a4, pPrx=0xff92c0, dwProperty=2, pdwValue=0x18e620 | out: pdwValue=0x18e620) returned 0x80004002 [0163.081] WbemLocator:IUnknown:Release (This=0xff92a4) returned 0x3 [0163.081] WbemLocator:IUnknown:Release (This=0xff92c0) returned 0x2 [0163.081] CoGetContextToken (in: pToken=0x18eb60 | out: pToken=0x18eb60) returned 0x0 [0163.081] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0163.081] WbemLocator:IUnknown:QueryInterface (in: This=0xff92c0, riid=0x18eb90*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18eb8c | out: ppvObject=0x18eb8c*=0x1010580) returned 0x0 [0163.081] IUnknown:AddRef (This=0x1010580) returned 0x4 [0163.081] IUnknown:Release (This=0x1010580) returned 0x3 [0163.081] IUnknown:Release (This=0x1010580) returned 0x2 [0163.081] IUnknown:Release (This=0x10107d8) returned 0x2 [0163.081] SysStringLen (param_1=0x0) returned 0x0 [0163.081] IEnumWbemClassObject:Reset (This=0x1010580) returned 0x0 [0163.083] CoTaskMemAlloc (cb=0x4) returned 0xfdc2b0 [0163.083] IEnumWbemClassObject:Next (in: This=0x1010580, lTimeout=-1, uCount=0x1, apObjects=0xfdc2b0, puReturned=0x27072f8 | out: apObjects=0xfdc2b0*=0x1031eb0, puReturned=0x27072f8*=0x1) returned 0x0 [0163.087] IUnknown:QueryInterface (in: This=0x1031eb0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e410 | out: ppvObject=0x18e410*=0x1031eb0) returned 0x0 [0163.087] IUnknown:QueryInterface (in: This=0x1031eb0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e3cc | out: ppvObject=0x18e3cc*=0x0) returned 0x80004002 [0163.087] IUnknown:QueryInterface (in: This=0x1031eb0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e1ec | out: ppvObject=0x18e1ec*=0x0) returned 0x80004002 [0163.087] IUnknown:QueryInterface (in: This=0x1031eb0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dfc4 | out: ppvObject=0x18dfc4*=0x0) returned 0x80004002 [0163.087] IUnknown:AddRef (This=0x1031eb0) returned 0x3 [0163.088] IUnknown:QueryInterface (in: This=0x1031eb0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0163.088] IUnknown:QueryInterface (in: This=0x1031eb0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dcd4 | out: ppvObject=0x18dcd4*=0x0) returned 0x80004002 [0163.088] IUnknown:QueryInterface (in: This=0x1031eb0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dce0 | out: ppvObject=0x18dce0*=0x1031eb4) returned 0x0 [0163.088] IMarshal:GetUnmarshalClass (in: This=0x1031eb4, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dce8 | out: pCid=0x18dce8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0163.088] IUnknown:Release (This=0x1031eb4) returned 0x3 [0163.088] CoGetContextToken (in: pToken=0x18dd40 | out: pToken=0x18dd40) returned 0x0 [0163.088] CoGetContextToken (in: pToken=0x18e148 | out: pToken=0x18e148) returned 0x0 [0163.088] IUnknown:QueryInterface (in: This=0x1031eb0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0163.088] IUnknown:Release (This=0x1031eb0) returned 0x2 [0163.088] CoGetContextToken (in: pToken=0x18e720 | out: pToken=0x18e720) returned 0x0 [0163.088] CoGetContextToken (in: pToken=0x18e680 | out: pToken=0x18e680) returned 0x0 [0163.088] IUnknown:QueryInterface (in: This=0x1031eb0, riid=0x18e750*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e74c | out: ppvObject=0x18e74c*=0x1031eb0) returned 0x0 [0163.088] IUnknown:AddRef (This=0x1031eb0) returned 0x4 [0163.088] IUnknown:Release (This=0x1031eb0) returned 0x3 [0163.088] IUnknown:Release (This=0x1031eb0) returned 0x2 [0163.088] CoTaskMemFree (pv=0xfdc2b0) [0163.088] CoGetContextToken (in: pToken=0x18ea98 | out: pToken=0x18ea98) returned 0x0 [0163.088] IUnknown:AddRef (This=0x1031eb0) returned 0x3 [0163.088] CoTaskMemAlloc (cb=0x4) returned 0xfdc350 [0163.089] IEnumWbemClassObject:Next (in: This=0x1010580, lTimeout=-1, uCount=0x1, apObjects=0xfdc350, puReturned=0x27072f8 | out: apObjects=0xfdc350*=0x0, puReturned=0x27072f8*=0x0) returned 0x1 [0163.090] CoTaskMemFree (pv=0xfdc350) [0163.090] CoGetContextToken (in: pToken=0x18ec08 | out: pToken=0x18ec08) returned 0x0 [0163.090] IUnknown:AddRef (This=0x10107d8) returned 0x3 [0163.090] IEnumWbemClassObject:Clone (in: This=0x10107d8, ppEnum=0x18edc8 | out: ppEnum=0x18edc8*=0x1010af8) returned 0x0 [0163.091] IUnknown:QueryInterface (in: This=0x1010af8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec84 | out: ppvObject=0x18ec84*=0x1010afc) returned 0x0 [0163.091] IClientSecurity:QueryBlanket (in: This=0x1010afc, pProxy=0x1010af8, pAuthnSvc=0x18ecd4, pAuthzSvc=0x18ecd0, pServerPrincName=0x18ecc8, pAuthnLevel=0x18eccc, pImpLevel=0x18ecbc, pAuthInfo=0x18ecc0, pCapabilites=0x18ecc4 | out: pAuthnSvc=0x18ecd4*=0xa, pAuthzSvc=0x18ecd0*=0x0, pServerPrincName=0x18ecc8, pAuthnLevel=0x18eccc*=0x6, pImpLevel=0x18ecbc*=0x2, pAuthInfo=0x18ecc0, pCapabilites=0x18ecc4*=0x1) returned 0x0 [0163.091] IUnknown:Release (This=0x1010afc) returned 0x1 [0163.091] IUnknown:QueryInterface (in: This=0x1010af8, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec78 | out: ppvObject=0x18ec78*=0xff99c0) returned 0x0 [0163.091] IUnknown:QueryInterface (in: This=0x1010af8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec64 | out: ppvObject=0x18ec64*=0x1010afc) returned 0x0 [0163.092] IClientSecurity:SetBlanket (This=0x1010afc, pProxy=0x1010af8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0163.094] IUnknown:Release (This=0x1010afc) returned 0x2 [0163.094] WbemLocator:IUnknown:Release (This=0xff99c0) returned 0x1 [0163.094] CoTaskMemFree (pv=0x1057388) [0163.094] IUnknown:QueryInterface (in: This=0x1010af8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e860 | out: ppvObject=0x18e860*=0xff99c0) returned 0x0 [0163.094] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e81c | out: ppvObject=0x18e81c*=0x0) returned 0x80004002 [0163.095] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e63c | out: ppvObject=0x18e63c*=0x0) returned 0x80004002 [0163.096] IUnknown:QueryInterface (in: This=0x1010af8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e414 | out: ppvObject=0x18e414*=0x0) returned 0x80004002 [0163.096] WbemLocator:IUnknown:AddRef (This=0xff99c0) returned 0x3 [0163.097] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e174 | out: ppvObject=0x18e174*=0x0) returned 0x80004002 [0163.097] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e124 | out: ppvObject=0x18e124*=0x0) returned 0x80004002 [0163.097] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e130 | out: ppvObject=0x18e130*=0xff991c) returned 0x0 [0163.097] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff991c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e138 | out: pCid=0x18e138*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.097] WbemLocator:IUnknown:Release (This=0xff991c) returned 0x3 [0163.097] CoGetContextToken (in: pToken=0x18e190 | out: pToken=0x18e190) returned 0x0 [0163.097] CoGetContextToken (in: pToken=0x18e598 | out: pToken=0x18e598) returned 0x0 [0163.097] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e624 | out: ppvObject=0x18e624*=0xff99a4) returned 0x0 [0163.097] WbemLocator:IRpcOptions:Query (in: This=0xff99a4, pPrx=0xff99c0, dwProperty=2, pdwValue=0x18e630 | out: pdwValue=0x18e630) returned 0x80004002 [0163.097] WbemLocator:IUnknown:Release (This=0xff99a4) returned 0x3 [0163.097] WbemLocator:IUnknown:Release (This=0xff99c0) returned 0x2 [0163.097] CoGetContextToken (in: pToken=0x18eb70 | out: pToken=0x18eb70) returned 0x0 [0163.097] CoGetContextToken (in: pToken=0x18ead0 | out: pToken=0x18ead0) returned 0x0 [0163.097] WbemLocator:IUnknown:QueryInterface (in: This=0xff99c0, riid=0x18eba0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18eb9c | out: ppvObject=0x18eb9c*=0x1010af8) returned 0x0 [0163.098] IUnknown:AddRef (This=0x1010af8) returned 0x4 [0163.098] IUnknown:Release (This=0x1010af8) returned 0x3 [0163.098] IUnknown:Release (This=0x1010af8) returned 0x2 [0163.098] IUnknown:Release (This=0x10107d8) returned 0x2 [0163.098] SysStringLen (param_1=0x0) returned 0x0 [0163.098] IEnumWbemClassObject:Reset (This=0x1010af8) returned 0x0 [0163.099] CoTaskMemAlloc (cb=0x4) returned 0xfdc330 [0163.099] IEnumWbemClassObject:Next (in: This=0x1010af8, lTimeout=-1, uCount=0x1, apObjects=0xfdc330, puReturned=0x27073dc | out: apObjects=0xfdc330*=0x10319e8, puReturned=0x27073dc*=0x1) returned 0x0 [0163.104] IUnknown:QueryInterface (in: This=0x10319e8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e420 | out: ppvObject=0x18e420*=0x10319e8) returned 0x0 [0163.104] IUnknown:QueryInterface (in: This=0x10319e8, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e3dc | out: ppvObject=0x18e3dc*=0x0) returned 0x80004002 [0163.104] IUnknown:QueryInterface (in: This=0x10319e8, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e1fc | out: ppvObject=0x18e1fc*=0x0) returned 0x80004002 [0163.104] IUnknown:QueryInterface (in: This=0x10319e8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dfd4 | out: ppvObject=0x18dfd4*=0x0) returned 0x80004002 [0163.104] IUnknown:AddRef (This=0x10319e8) returned 0x3 [0163.104] IUnknown:QueryInterface (in: This=0x10319e8, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dd34 | out: ppvObject=0x18dd34*=0x0) returned 0x80004002 [0163.104] IUnknown:QueryInterface (in: This=0x10319e8, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dce4 | out: ppvObject=0x18dce4*=0x0) returned 0x80004002 [0163.104] IUnknown:QueryInterface (in: This=0x10319e8, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dcf0 | out: ppvObject=0x18dcf0*=0x10319ec) returned 0x0 [0163.104] IMarshal:GetUnmarshalClass (in: This=0x10319ec, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dcf8 | out: pCid=0x18dcf8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0163.104] IUnknown:Release (This=0x10319ec) returned 0x3 [0163.104] CoGetContextToken (in: pToken=0x18dd50 | out: pToken=0x18dd50) returned 0x0 [0163.104] CoGetContextToken (in: pToken=0x18e158 | out: pToken=0x18e158) returned 0x0 [0163.105] IUnknown:QueryInterface (in: This=0x10319e8, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1e4 | out: ppvObject=0x18e1e4*=0x0) returned 0x80004002 [0163.105] IUnknown:Release (This=0x10319e8) returned 0x2 [0163.105] CoGetContextToken (in: pToken=0x18e730 | out: pToken=0x18e730) returned 0x0 [0163.105] CoGetContextToken (in: pToken=0x18e690 | out: pToken=0x18e690) returned 0x0 [0163.105] IUnknown:QueryInterface (in: This=0x10319e8, riid=0x18e760*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e75c | out: ppvObject=0x18e75c*=0x10319e8) returned 0x0 [0163.105] IUnknown:AddRef (This=0x10319e8) returned 0x4 [0163.105] IUnknown:Release (This=0x10319e8) returned 0x3 [0163.105] IUnknown:Release (This=0x10319e8) returned 0x2 [0163.105] CoTaskMemFree (pv=0xfdc330) [0163.105] CoGetContextToken (in: pToken=0x18eaa8 | out: pToken=0x18eaa8) returned 0x0 [0163.105] IUnknown:AddRef (This=0x10319e8) returned 0x3 [0163.105] IWbemClassObject:Get (in: This=0x10319e8, wszName="__GENUS", lFlags=0, pVal=0x18edb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee38*=0, plFlavor=0x18ee34*=0 | out: pVal=0x18edb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ee38*=3, plFlavor=0x18ee34*=64) returned 0x0 [0163.105] IWbemClassObject:Get (in: This=0x10319e8, wszName="__PATH", lFlags=0, pVal=0x18ed9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee20*=0, plFlavor=0x18ee1c*=0 | out: pVal=0x18ed9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x18ee20*=8, plFlavor=0x18ee1c*=64) returned 0x0 [0163.105] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0163.105] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0163.106] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x440 [0163.106] SetEvent (hEvent=0x30c) returned 1 [0163.106] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed74*=0x440, lpdwindex=0x18eb94 | out: lpdwindex=0x18eb94) returned 0x0 [0163.109] CoGetContextToken (in: pToken=0x18ec40 | out: pToken=0x18ec40) returned 0x0 [0163.109] CoGetContextToken (in: pToken=0x18eba0 | out: pToken=0x18eba0) returned 0x0 [0163.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037830, riid=0x18ec70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ec6c | out: ppvObject=0x18ec6c*=0x1037830) returned 0x0 [0163.109] WbemDefPath:IUnknown:AddRef (This=0x1037830) returned 0x3 [0163.109] WbemDefPath:IUnknown:Release (This=0x1037830) returned 0x2 [0163.109] WbemDefPath:IWbemPath:SetText (This=0x1037830, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0163.109] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18edf4 | out: puCount=0x18edf4*=0x2) returned 0x0 [0163.109] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edf0*=0x0, pszText=0x0 | out: puBuffLength=0x18edf0*=0xf, pszText=0x0) returned 0x0 [0163.109] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18edf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.109] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ede8 | out: puCount=0x18ede8*=0x2) returned 0x0 [0163.109] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ede4*=0x0, pszText=0x0 | out: puBuffLength=0x18ede4*=0xf, pszText=0x0) returned 0x0 [0163.109] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ede4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ede4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.109] IWbemClassObject:Get (in: This=0x10319e8, wszName="Name", lFlags=0, pVal=0x18ede4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2707c38*=0, plFlavor=0x2707c3c*=0 | out: pVal=0x18ede4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x2707c38*=8, plFlavor=0x2707c3c*=0) returned 0x0 [0163.110] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0163.110] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0163.110] IWbemClassObject:Get (in: This=0x10319e8, wszName="Name", lFlags=0, pVal=0x18edec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2707c38*=8, plFlavor=0x2707c3c*=0 | out: pVal=0x18edec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x2707c38*=8, plFlavor=0x2707c3c*=0) returned 0x0 [0163.110] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0163.110] SysStringByteLen (bstr="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x80 [0163.110] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee3c | out: puCount=0x18ee3c*=0x2) returned 0x0 [0163.110] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee38*=0x0, pszText=0x0 | out: puBuffLength=0x18ee38*=0xf, pszText=0x0) returned 0x0 [0163.110] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee38*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee38*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.121] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ece4*=0x414, lpdwindex=0x18eb94 | out: lpdwindex=0x18eb94) returned 0x0 [0163.151] CoGetContextToken (in: pToken=0x18eaa8 | out: pToken=0x18eaa8) returned 0x0 [0163.151] CoGetContextToken (in: pToken=0x18ea50 | out: pToken=0x18ea50) returned 0x0 [0163.151] IUnknown:QueryInterface (in: This=0xfb21f0, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea2c | out: ppvObject=0x18ea2c*=0xfb2200) returned 0x0 [0163.151] CObjectContext::ContextCallback () returned 0x0 [0163.153] IUnknown:Release (This=0xfb2200) returned 0x1 [0163.153] CoUnmarshalInterface (in: pStm=0xff2ba0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ea9c | out: ppv=0x18ea9c*=0x101c930) returned 0x0 [0163.153] CoMarshalInterface (pStm=0xff2ba0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x101c930, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0163.154] WbemLocator:IUnknown:QueryInterface (in: This=0x101c930, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e93c | out: ppvObject=0x18e93c*=0x101c930) returned 0x0 [0163.154] WbemLocator:IUnknown:QueryInterface (in: This=0x101c930, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e8f8 | out: ppvObject=0x18e8f8*=0x0) returned 0x80004002 [0163.154] WbemLocator:IUnknown:QueryInterface (in: This=0x101c930, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e714 | out: ppvObject=0x18e714*=0x0) returned 0x80004002 [0163.155] WbemLocator:IUnknown:QueryInterface (in: This=0x101c930, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e4ec | out: ppvObject=0x18e4ec*=0x0) returned 0x80004002 [0163.155] WbemLocator:IUnknown:AddRef (This=0x101c930) returned 0x3 [0163.155] WbemLocator:IUnknown:QueryInterface (in: This=0x101c930, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e24c | out: ppvObject=0x18e24c*=0x0) returned 0x80004002 [0163.155] WbemLocator:IUnknown:QueryInterface (in: This=0x101c930, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e1fc | out: ppvObject=0x18e1fc*=0x0) returned 0x80004002 [0163.155] WbemLocator:IUnknown:QueryInterface (in: This=0x101c930, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e208 | out: ppvObject=0x18e208*=0x101c88c) returned 0x0 [0163.156] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x101c88c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e210 | out: pCid=0x18e210*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.156] WbemLocator:IUnknown:Release (This=0x101c88c) returned 0x3 [0163.156] CoGetContextToken (in: pToken=0x18e268 | out: pToken=0x18e268) returned 0x0 [0163.156] CoGetContextToken (in: pToken=0x18e670 | out: pToken=0x18e670) returned 0x0 [0163.156] WbemLocator:IUnknown:QueryInterface (in: This=0x101c930, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6fc | out: ppvObject=0x18e6fc*=0x101c914) returned 0x0 [0163.156] WbemLocator:IRpcOptions:Query (in: This=0x101c914, pPrx=0x101c930, dwProperty=2, pdwValue=0x18e708 | out: pdwValue=0x18e708) returned 0x0 [0163.156] WbemLocator:IUnknown:Release (This=0x101c914) returned 0x3 [0163.156] WbemLocator:IUnknown:Release (This=0x101c930) returned 0x2 [0163.156] WbemLocator:IUnknown:Release (This=0x101c930) returned 0x1 [0163.156] CoGetContextToken (in: pToken=0x18e9e8 | out: pToken=0x18e9e8) returned 0x0 [0163.156] WbemLocator:IUnknown:AddRef (This=0x101c930) returned 0x2 [0163.156] WbemLocator:IUnknown:QueryInterface (in: This=0x101c930, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec9c | out: ppvObject=0x18ec9c*=0x101c90c) returned 0x0 [0163.157] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x101c90c, pProxy=0x101c930, pAuthnSvc=0x18ecec, pAuthzSvc=0x18ece8, pServerPrincName=0x18ece0, pAuthnLevel=0x18ece4, pImpLevel=0x18ecd4, pAuthInfo=0x18ecd8, pCapabilites=0x18ecdc | out: pAuthnSvc=0x18ecec*=0xa, pAuthzSvc=0x18ece8*=0x0, pServerPrincName=0x18ece0, pAuthnLevel=0x18ece4*=0x6, pImpLevel=0x18ecd4*=0x2, pAuthInfo=0x18ecd8, pCapabilites=0x18ecdc*=0x1) returned 0x0 [0163.157] WbemLocator:IUnknown:Release (This=0x101c90c) returned 0x2 [0163.157] WbemLocator:IUnknown:QueryInterface (in: This=0x101c930, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec90 | out: ppvObject=0x18ec90*=0x101c930) returned 0x0 [0163.157] WbemLocator:IUnknown:QueryInterface (in: This=0x101c930, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec7c | out: ppvObject=0x18ec7c*=0x101c90c) returned 0x0 [0163.157] WbemLocator:IClientSecurity:SetBlanket (This=0x101c90c, pProxy=0x101c930, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0163.157] WbemLocator:IUnknown:Release (This=0x101c90c) returned 0x3 [0163.157] WbemLocator:IUnknown:Release (This=0x101c930) returned 0x2 [0163.157] CoTaskMemFree (pv=0x1057598) [0163.157] WbemLocator:IUnknown:Release (This=0x101c930) returned 0x1 [0163.157] SysStringLen (param_1=0x0) returned 0x0 [0163.157] CoGetContextToken (in: pToken=0x18ec58 | out: pToken=0x18ec58) returned 0x0 [0163.157] CoGetContextToken (in: pToken=0x18ebb8 | out: pToken=0x18ebb8) returned 0x0 [0163.158] WbemLocator:IUnknown:QueryInterface (in: This=0x101c930, riid=0x18ec88*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18ec84 | out: ppvObject=0x18ec84*=0x103b9c8) returned 0x0 [0163.158] WbemLocator:IUnknown:AddRef (This=0x103b9c8) returned 0x3 [0163.158] WbemLocator:IUnknown:Release (This=0x103b9c8) returned 0x2 [0163.158] CoGetContextToken (in: pToken=0x18ec18 | out: pToken=0x18ec18) returned 0x0 [0163.158] WbemLocator:IUnknown:AddRef (This=0x103b9c8) returned 0x3 [0163.159] WbemLocator:IUnknown:QueryInterface (in: This=0x103b9c8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec9c | out: ppvObject=0x18ec9c*=0x101c90c) returned 0x0 [0163.159] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x101c90c, pProxy=0x103b9c8, pAuthnSvc=0x18ecec, pAuthzSvc=0x18ece8, pServerPrincName=0x18ece0, pAuthnLevel=0x18ece4, pImpLevel=0x18ecd4, pAuthInfo=0x18ecd8, pCapabilites=0x18ecdc | out: pAuthnSvc=0x18ecec*=0xa, pAuthzSvc=0x18ece8*=0x0, pServerPrincName=0x18ece0, pAuthnLevel=0x18ece4*=0x6, pImpLevel=0x18ecd4*=0x2, pAuthInfo=0x18ecd8, pCapabilites=0x18ecdc*=0x1) returned 0x0 [0163.159] WbemLocator:IUnknown:Release (This=0x101c90c) returned 0x3 [0163.159] WbemLocator:IUnknown:QueryInterface (in: This=0x103b9c8, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec90 | out: ppvObject=0x18ec90*=0x101c930) returned 0x0 [0163.159] WbemLocator:IUnknown:QueryInterface (in: This=0x103b9c8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec7c | out: ppvObject=0x18ec7c*=0x101c90c) returned 0x0 [0163.159] WbemLocator:IClientSecurity:SetBlanket (This=0x101c90c, pProxy=0x103b9c8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0163.159] WbemLocator:IUnknown:Release (This=0x101c90c) returned 0x4 [0163.159] WbemLocator:IUnknown:Release (This=0x101c930) returned 0x3 [0163.159] CoTaskMemFree (pv=0x1057388) [0163.160] WbemLocator:IUnknown:Release (This=0x103b9c8) returned 0x2 [0163.160] SysStringLen (param_1=0x0) returned 0x0 [0163.160] CoGetContextToken (in: pToken=0x18eba0 | out: pToken=0x18eba0) returned 0x0 [0163.160] WbemLocator:IUnknown:AddRef (This=0x103b9c8) returned 0x3 [0163.160] IWbemServices:ExecQuery (in: This=0x103b9c8, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x18edac | out: ppEnum=0x18edac*=0x10103f0) returned 0x0 [0163.229] IUnknown:QueryInterface (in: This=0x10103f0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec08 | out: ppvObject=0x18ec08*=0x10103f4) returned 0x0 [0163.229] IClientSecurity:QueryBlanket (in: This=0x10103f4, pProxy=0x10103f0, pAuthnSvc=0x18ec58, pAuthzSvc=0x18ec54, pServerPrincName=0x18ec4c, pAuthnLevel=0x18ec50, pImpLevel=0x18ec40, pAuthInfo=0x18ec44, pCapabilites=0x18ec48 | out: pAuthnSvc=0x18ec58*=0xa, pAuthzSvc=0x18ec54*=0x0, pServerPrincName=0x18ec4c, pAuthnLevel=0x18ec50*=0x6, pImpLevel=0x18ec40*=0x2, pAuthInfo=0x18ec44, pCapabilites=0x18ec48*=0x1) returned 0x0 [0163.229] IUnknown:Release (This=0x10103f4) returned 0x1 [0163.229] IUnknown:QueryInterface (in: This=0x10103f0, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebfc | out: ppvObject=0x18ebfc*=0x101c330) returned 0x0 [0163.229] IUnknown:QueryInterface (in: This=0x10103f0, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ebe8 | out: ppvObject=0x18ebe8*=0x10103f4) returned 0x0 [0163.229] IClientSecurity:SetBlanket (This=0x10103f4, pProxy=0x10103f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0163.231] IUnknown:Release (This=0x10103f4) returned 0x2 [0163.231] WbemLocator:IUnknown:Release (This=0x101c330) returned 0x1 [0163.231] CoTaskMemFree (pv=0x1057388) [0163.232] IUnknown:QueryInterface (in: This=0x10103f0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e7f4 | out: ppvObject=0x18e7f4*=0x101c330) returned 0x0 [0163.232] WbemLocator:IUnknown:QueryInterface (in: This=0x101c330, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e7b0 | out: ppvObject=0x18e7b0*=0x0) returned 0x80004002 [0163.232] WbemLocator:IUnknown:QueryInterface (in: This=0x101c330, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e5cc | out: ppvObject=0x18e5cc*=0x0) returned 0x80004002 [0163.233] IUnknown:QueryInterface (in: This=0x10103f0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x0) returned 0x80004002 [0163.234] WbemLocator:IUnknown:AddRef (This=0x101c330) returned 0x3 [0163.234] WbemLocator:IUnknown:QueryInterface (in: This=0x101c330, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e104 | out: ppvObject=0x18e104*=0x0) returned 0x80004002 [0163.234] WbemLocator:IUnknown:QueryInterface (in: This=0x101c330, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e0b4 | out: ppvObject=0x18e0b4*=0x0) returned 0x80004002 [0163.234] WbemLocator:IUnknown:QueryInterface (in: This=0x101c330, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e0c0 | out: ppvObject=0x18e0c0*=0x101c28c) returned 0x0 [0163.234] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x101c28c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e0c8 | out: pCid=0x18e0c8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.234] WbemLocator:IUnknown:Release (This=0x101c28c) returned 0x3 [0163.234] CoGetContextToken (in: pToken=0x18e120 | out: pToken=0x18e120) returned 0x0 [0163.234] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0163.234] WbemLocator:IUnknown:QueryInterface (in: This=0x101c330, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5b4 | out: ppvObject=0x18e5b4*=0x101c314) returned 0x0 [0163.234] WbemLocator:IRpcOptions:Query (in: This=0x101c314, pPrx=0x101c330, dwProperty=2, pdwValue=0x18e5c0 | out: pdwValue=0x18e5c0) returned 0x80004002 [0163.234] WbemLocator:IUnknown:Release (This=0x101c314) returned 0x3 [0163.234] WbemLocator:IUnknown:Release (This=0x101c330) returned 0x2 [0163.234] CoGetContextToken (in: pToken=0x18eb08 | out: pToken=0x18eb08) returned 0x0 [0163.235] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0163.235] WbemLocator:IUnknown:QueryInterface (in: This=0x101c330, riid=0x18eb38*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18eb34 | out: ppvObject=0x18eb34*=0x10103f0) returned 0x0 [0163.235] IUnknown:AddRef (This=0x10103f0) returned 0x4 [0163.235] IUnknown:Release (This=0x10103f0) returned 0x3 [0163.235] IUnknown:Release (This=0x10103f0) returned 0x2 [0163.235] WbemLocator:IUnknown:Release (This=0x103b9c8) returned 0x2 [0163.235] SysStringLen (param_1=0x0) returned 0x0 [0163.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18edf8 | out: puCount=0x18edf8*=0x2) returned 0x0 [0163.235] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edf4*=0x0, pszText=0x0 | out: puBuffLength=0x18edf4*=0xf, pszText=0x0) returned 0x0 [0163.235] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edf4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18edf4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.235] CoGetContextToken (in: pToken=0x18ec20 | out: pToken=0x18ec20) returned 0x0 [0163.235] IUnknown:AddRef (This=0x10103f0) returned 0x3 [0163.235] IEnumWbemClassObject:Clone (in: This=0x10103f0, ppEnum=0x18eddc | out: ppEnum=0x18eddc*=0x1010d50) returned 0x0 [0163.237] IUnknown:QueryInterface (in: This=0x1010d50, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec98 | out: ppvObject=0x18ec98*=0x1010d54) returned 0x0 [0163.237] IClientSecurity:QueryBlanket (in: This=0x1010d54, pProxy=0x1010d50, pAuthnSvc=0x18ece8, pAuthzSvc=0x18ece4, pServerPrincName=0x18ecdc, pAuthnLevel=0x18ece0, pImpLevel=0x18ecd0, pAuthInfo=0x18ecd4, pCapabilites=0x18ecd8 | out: pAuthnSvc=0x18ece8*=0xa, pAuthzSvc=0x18ece4*=0x0, pServerPrincName=0x18ecdc, pAuthnLevel=0x18ece0*=0x6, pImpLevel=0x18ecd0*=0x2, pAuthInfo=0x18ecd4, pCapabilites=0x18ecd8*=0x1) returned 0x0 [0163.237] IUnknown:Release (This=0x1010d54) returned 0x1 [0163.237] IUnknown:QueryInterface (in: This=0x1010d50, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec8c | out: ppvObject=0x18ec8c*=0x101be30) returned 0x0 [0163.237] IUnknown:QueryInterface (in: This=0x1010d50, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ec78 | out: ppvObject=0x18ec78*=0x1010d54) returned 0x0 [0163.237] IClientSecurity:SetBlanket (This=0x1010d54, pProxy=0x1010d50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0163.357] IUnknown:Release (This=0x1010d54) returned 0x2 [0163.357] WbemLocator:IUnknown:Release (This=0x101be30) returned 0x1 [0163.357] CoTaskMemFree (pv=0x10576b8) [0163.357] IUnknown:QueryInterface (in: This=0x1010d50, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e874 | out: ppvObject=0x18e874*=0x101be30) returned 0x0 [0163.358] WbemLocator:IUnknown:QueryInterface (in: This=0x101be30, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e830 | out: ppvObject=0x18e830*=0x0) returned 0x80004002 [0163.427] WbemLocator:IUnknown:QueryInterface (in: This=0x101be30, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e64c | out: ppvObject=0x18e64c*=0x0) returned 0x80004002 [0163.451] IUnknown:QueryInterface (in: This=0x1010d50, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e424 | out: ppvObject=0x18e424*=0x0) returned 0x80004002 [0163.452] WbemLocator:IUnknown:AddRef (This=0x101be30) returned 0x3 [0163.452] WbemLocator:IUnknown:QueryInterface (in: This=0x101be30, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18e184 | out: ppvObject=0x18e184*=0x0) returned 0x80004002 [0163.452] WbemLocator:IUnknown:QueryInterface (in: This=0x101be30, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18e134 | out: ppvObject=0x18e134*=0x0) returned 0x80004002 [0163.452] WbemLocator:IUnknown:QueryInterface (in: This=0x101be30, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e140 | out: ppvObject=0x18e140*=0x101bd8c) returned 0x0 [0163.452] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x101bd8c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18e148 | out: pCid=0x18e148*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.452] WbemLocator:IUnknown:Release (This=0x101bd8c) returned 0x3 [0163.452] CoGetContextToken (in: pToken=0x18e1a0 | out: pToken=0x18e1a0) returned 0x0 [0163.452] CoGetContextToken (in: pToken=0x18e5a8 | out: pToken=0x18e5a8) returned 0x0 [0163.452] WbemLocator:IUnknown:QueryInterface (in: This=0x101be30, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e634 | out: ppvObject=0x18e634*=0x101be14) returned 0x0 [0163.452] WbemLocator:IRpcOptions:Query (in: This=0x101be14, pPrx=0x101be30, dwProperty=2, pdwValue=0x18e640 | out: pdwValue=0x18e640) returned 0x80004002 [0163.452] WbemLocator:IUnknown:Release (This=0x101be14) returned 0x3 [0163.453] WbemLocator:IUnknown:Release (This=0x101be30) returned 0x2 [0163.453] CoGetContextToken (in: pToken=0x18eb88 | out: pToken=0x18eb88) returned 0x0 [0163.453] CoGetContextToken (in: pToken=0x18eae8 | out: pToken=0x18eae8) returned 0x0 [0163.453] WbemLocator:IUnknown:QueryInterface (in: This=0x101be30, riid=0x18ebb8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18ebb4 | out: ppvObject=0x18ebb4*=0x1010d50) returned 0x0 [0163.453] IUnknown:AddRef (This=0x1010d50) returned 0x4 [0163.453] IUnknown:Release (This=0x1010d50) returned 0x3 [0163.453] IUnknown:Release (This=0x1010d50) returned 0x2 [0163.453] IUnknown:Release (This=0x10103f0) returned 0x2 [0163.453] SysStringLen (param_1=0x0) returned 0x0 [0163.453] IEnumWbemClassObject:Reset (This=0x1010d50) returned 0x0 [0163.454] CoTaskMemAlloc (cb=0x4) returned 0x1033620 [0163.454] IEnumWbemClassObject:Next (in: This=0x1010d50, lTimeout=-1, uCount=0x1, apObjects=0x1033620, puReturned=0x2708910 | out: apObjects=0x1033620*=0x1031b80, puReturned=0x2708910*=0x1) returned 0x0 [0164.511] IUnknown:QueryInterface (in: This=0x1031b80, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e438 | out: ppvObject=0x18e438*=0x1031b80) returned 0x0 [0164.512] IUnknown:QueryInterface (in: This=0x1031b80, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e3f4 | out: ppvObject=0x18e3f4*=0x0) returned 0x80004002 [0164.512] IUnknown:QueryInterface (in: This=0x1031b80, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e214 | out: ppvObject=0x18e214*=0x0) returned 0x80004002 [0164.512] IUnknown:QueryInterface (in: This=0x1031b80, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dfec | out: ppvObject=0x18dfec*=0x0) returned 0x80004002 [0164.512] IUnknown:AddRef (This=0x1031b80) returned 0x3 [0164.512] IUnknown:QueryInterface (in: This=0x1031b80, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dd4c | out: ppvObject=0x18dd4c*=0x0) returned 0x80004002 [0164.512] IUnknown:QueryInterface (in: This=0x1031b80, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dcfc | out: ppvObject=0x18dcfc*=0x0) returned 0x80004002 [0164.512] IUnknown:QueryInterface (in: This=0x1031b80, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dd08 | out: ppvObject=0x18dd08*=0x1031b84) returned 0x0 [0164.512] IMarshal:GetUnmarshalClass (in: This=0x1031b84, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd10 | out: pCid=0x18dd10*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0164.512] IUnknown:Release (This=0x1031b84) returned 0x3 [0164.512] CoGetContextToken (in: pToken=0x18dd68 | out: pToken=0x18dd68) returned 0x0 [0164.512] CoGetContextToken (in: pToken=0x18e170 | out: pToken=0x18e170) returned 0x0 [0164.512] IUnknown:QueryInterface (in: This=0x1031b80, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1fc | out: ppvObject=0x18e1fc*=0x0) returned 0x80004002 [0164.512] IUnknown:Release (This=0x1031b80) returned 0x2 [0164.512] CoGetContextToken (in: pToken=0x18e748 | out: pToken=0x18e748) returned 0x0 [0164.512] CoGetContextToken (in: pToken=0x18e6a8 | out: pToken=0x18e6a8) returned 0x0 [0164.512] IUnknown:QueryInterface (in: This=0x1031b80, riid=0x18e778*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x1031b80) returned 0x0 [0164.512] IUnknown:AddRef (This=0x1031b80) returned 0x4 [0164.512] IUnknown:Release (This=0x1031b80) returned 0x3 [0164.513] IUnknown:Release (This=0x1031b80) returned 0x2 [0164.513] CoTaskMemFree (pv=0x1033620) [0164.513] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0164.513] IUnknown:AddRef (This=0x1031b80) returned 0x3 [0164.513] IWbemClassObject:Get (in: This=0x1031b80, wszName="__GENUS", lFlags=0, pVal=0x18edcc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee4c*=0, plFlavor=0x18ee48*=0 | out: pVal=0x18edcc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ee4c*=3, plFlavor=0x18ee48*=64) returned 0x0 [0164.513] IWbemClassObject:Get (in: This=0x1031b80, wszName="__PATH", lFlags=0, pVal=0x18edb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ee34*=0, plFlavor=0x18ee30*=0 | out: pVal=0x18edb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x18ee34*=8, plFlavor=0x18ee30*=64) returned 0x0 [0164.513] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0164.513] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0164.513] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x424 [0164.513] SetEvent (hEvent=0x30c) returned 1 [0164.514] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x18ed88*=0x424, lpdwindex=0x18eba4 | out: lpdwindex=0x18eba4) returned 0x0 [0164.516] CoGetContextToken (in: pToken=0x18ec58 | out: pToken=0x18ec58) returned 0x0 [0164.516] CoGetContextToken (in: pToken=0x18ebb8 | out: pToken=0x18ebb8) returned 0x0 [0164.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038320, riid=0x18ec88*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ec84 | out: ppvObject=0x18ec84*=0x1038320) returned 0x0 [0164.516] WbemDefPath:IUnknown:AddRef (This=0x1038320) returned 0x3 [0164.516] WbemDefPath:IUnknown:Release (This=0x1038320) returned 0x2 [0164.516] WbemDefPath:IWbemPath:SetText (This=0x1038320, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0164.516] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee08 | out: puCount=0x18ee08*=0x2) returned 0x0 [0164.516] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee04*=0x0, pszText=0x0 | out: puBuffLength=0x18ee04*=0xf, pszText=0x0) returned 0x0 [0164.516] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee04*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee04*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0164.516] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee00 | out: puCount=0x18ee00*=0x2) returned 0x0 [0164.516] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edfc*=0x0, pszText=0x0 | out: puBuffLength=0x18edfc*=0xf, pszText=0x0) returned 0x0 [0164.517] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18edfc*=0xf, pszText="00000000000000" | out: puBuffLength=0x18edfc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0164.517] IWbemClassObject:Get (in: This=0x1031b80, wszName="Name", lFlags=0, pVal=0x18edfc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2709160*=0, plFlavor=0x2709164*=0 | out: pVal=0x18edfc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x2709160*=8, plFlavor=0x2709164*=0) returned 0x0 [0164.517] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0164.517] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0164.517] IWbemClassObject:Get (in: This=0x1031b80, wszName="Name", lFlags=0, pVal=0x18ee04*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2709160*=8, plFlavor=0x2709164*=0 | out: pVal=0x18ee04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x2709160*=8, plFlavor=0x2709164*=0) returned 0x0 [0164.517] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0164.517] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0164.517] CoGetContextToken (in: pToken=0x18ecf8 | out: pToken=0x18ecf8) returned 0x0 [0164.517] WbemLocator:IUnknown:Release (This=0x101be30) returned 0x1 [0164.517] IUnknown:Release (This=0x1010d50) returned 0x0 [0164.522] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x18ee3c | out: puCount=0x18ee3c*=0x2) returned 0x0 [0164.522] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee38*=0x0, pszText=0x0 | out: puBuffLength=0x18ee38*=0xf, pszText=0x0) returned 0x0 [0164.522] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=4, puBuffLength=0x18ee38*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ee38*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0164.522] GlobalMemoryStatusEx (in: lpBuffer=0x2709350 | out: lpBuffer=0x2709350) returned 1 [0164.579] CoCreateGuid (in: pguid=0x18ee68 | out: pguid=0x18ee68*(Data1=0x794a7b62, Data2=0xa967, Data3=0x425e, Data4=([0]=0xb2, [1]=0xc, [2]=0x93, [3]=0x94, [4]=0x4c, [5]=0xf2, [6]=0x1e, [7]=0xd2))) returned 0x0 [0164.673] QueryPerformanceCounter (in: lpPerformanceCount=0x18ede4 | out: lpPerformanceCount=0x18ede4*=2294511886034) returned 1 [0164.676] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ec18*=0x4f4, lpdwindex=0x18ea34 | out: lpdwindex=0x18ea34) returned 0x80010115 [0164.677] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ebf8*=0x4e4, lpdwindex=0x18ea14 | out: lpdwindex=0x18ea14) returned 0x80010115 [0164.677] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ebf8*=0x4ec, lpdwindex=0x18ea14 | out: lpdwindex=0x18ea14) returned 0x80010115 [0164.677] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ec4c*=0x514, lpdwindex=0x18ea6c | out: lpdwindex=0x18ea6c) returned 0x80010115 [0164.678] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ec4c*=0x51c, lpdwindex=0x18ea6c | out: lpdwindex=0x18ea6c) returned 0x80010115 [0164.678] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ec4c*=0x524, lpdwindex=0x18ea6c | out: lpdwindex=0x18ea6c) returned 0x80010115 [0164.679] SetEvent (hEvent=0x230) returned 1 [0164.680] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x39c [0164.681] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x398 [0164.681] GetAddrInfoW (in: pNodeName="discord.com", pServiceName=0x0, pHints=0x18eb4c*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18eaf4 | out: ppResult=0x18eaf4*=0x104b408*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="discord.com", ai_addr=0x102df20*(sa_family=2, sin_port=0x0, sin_addr="162.159.128.233"), ai_next=0x104b5e8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x102e070*(sa_family=2, sin_port=0x0, sin_addr="162.159.138.232"), ai_next=0x104b610*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x102dfb0*(sa_family=2, sin_port=0x0, sin_addr="162.159.136.232"), ai_next=0x104b368*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x102e2f8*(sa_family=2, sin_port=0x0, sin_addr="162.159.137.232"), ai_next=0x104b390*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x102e3a0*(sa_family=2, sin_port=0x0, sin_addr="162.159.135.232"), ai_next=0x0)))))) returned 0 [0164.700] FreeAddrInfoW (pAddrInfo=0x104b408*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="discord.com", ai_addr=0x102df20*(sa_family=2, sin_port=0x0, sin_addr="162.159.128.233"), ai_next=0x104b5e8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x102e070*(sa_family=2, sin_port=0x0, sin_addr="162.159.138.232"), ai_next=0x104b610*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x102dfb0*(sa_family=2, sin_port=0x0, sin_addr="162.159.136.232"), ai_next=0x104b368*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x102e2f8*(sa_family=2, sin_port=0x0, sin_addr="162.159.137.232"), ai_next=0x104b390*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x102e3a0*(sa_family=2, sin_port=0x0, sin_addr="162.159.135.232"), ai_next=0x0)))))) [0164.701] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ea94*=0x5e8, lpdwindex=0x18e8b4 | out: lpdwindex=0x18e8b4) returned 0x80010115 [0164.701] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x18ea94*=0x5f0, lpdwindex=0x18e8b4 | out: lpdwindex=0x18e8b4) returned 0x80010115 [0164.701] WSAConnect (in: s=0x39c, name=0x270e438*(sa_family=2, sin_port=0x1bb, sin_addr="162.159.128.233"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0164.712] closesocket (s=0x398) returned 0 [0164.738] EnumerateSecurityPackagesW (in: pcPackages=0x18ea9c, ppPackageInfo=0x18ea30 | out: pcPackages=0x18ea9c, ppPackageInfo=0x18ea30) returned 0x0 [0164.751] FreeContextBuffer (in: pvContextBuffer=0x1003e20 | out: pvContextBuffer=0x1003e20) returned 0x0 [0164.763] GetCurrentProcess () returned 0xffffffff [0164.763] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e87c | out: TokenHandle=0x18e87c*=0x650) returned 1 [0164.764] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x270f3bc, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x18e8d0, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x27108b4, ptsExpiry=0x18e854 | out: phCredential=0x27108b4, ptsExpiry=0x18e854) returned 0x0 [0164.780] InitializeSecurityContextW (in: phCredential=0x18e894, phContext=0x0, pTargetName=0x270e480, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x2710aa8, pOutput=0x2710a40, pfContextAttr=0x270f390, ptsExpiry=0x18e88c | out: phNewContext=0x2710aa8, pOutput=0x2710a40, pfContextAttr=0x270f390, ptsExpiry=0x18e88c) returned 0x90312 [0164.781] FreeContextBuffer (in: pvContextBuffer=0x10105c0 | out: pvContextBuffer=0x10105c0) returned 0x0 [0164.786] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0164.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="AppPolicyGetClrCompat", cchWideChar=21, lpMultiByteStr=0x18e8d0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppPolicyGetClrCompatÃRmgA­z(ú\x12oØð\x18", lpUsedDefaultChar=0x0) returned 21 [0164.787] GetProcAddress (hModule=0x770a0000, lpProcName="AppPolicyGetClrCompat") returned 0x0 [0164.787] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0164.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="GetCurrentPackageId", cchWideChar=19, lpMultiByteStr=0x18e8d0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentPackageId", lpUsedDefaultChar=0x0) returned 19 [0164.787] GetProcAddress (hModule=0x770a0000, lpProcName="GetCurrentPackageId") returned 0x749dded0 [0164.787] GetCurrentPackageId () returned 0x3d54 [0164.804] send (s=0x39c, buf=0x2710abc*, len=175, flags=0) returned 175 [0164.805] recv (in: s=0x39c, buf=0x2710abc, len=5, flags=0 | out: buf=0x2710abc*) returned 5 [0164.814] recv (in: s=0x39c, buf=0x2710ac1, len=67, flags=0 | out: buf=0x2710ac1*) returned 67 [0164.815] InitializeSecurityContextW (in: phCredential=0x18e7f8, phContext=0x18e884, pTargetName=0x270e480, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2710e94, Reserved2=0x0, phNewContext=0x2710aa8, pOutput=0x2710ea8, pfContextAttr=0x270f390, ptsExpiry=0x18e7f0 | out: phNewContext=0x2710aa8, pOutput=0x2710ea8, pfContextAttr=0x270f390, ptsExpiry=0x18e7f0) returned 0x90312 [0164.815] recv (in: s=0x39c, buf=0x2710f38, len=5, flags=0 | out: buf=0x2710f38*) returned 5 [0164.816] recv (in: s=0x39c, buf=0x2710f51, len=2295, flags=0 | out: buf=0x2710f51*) returned 2295 [0164.816] InitializeSecurityContextW (in: phCredential=0x18e760, phContext=0x18e7ec, pTargetName=0x270e480, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x27118b8, Reserved2=0x0, phNewContext=0x2710aa8, pOutput=0x27118cc, pfContextAttr=0x270f390, ptsExpiry=0x18e758 | out: phNewContext=0x2710aa8, pOutput=0x27118cc, pfContextAttr=0x270f390, ptsExpiry=0x18e758) returned 0x90312 [0164.817] recv (in: s=0x39c, buf=0x271195c, len=5, flags=0 | out: buf=0x271195c*) returned 5 [0164.817] recv (in: s=0x39c, buf=0x2711975, len=148, flags=0 | out: buf=0x2711975*) returned 148 [0164.817] InitializeSecurityContextW (in: phCredential=0x18e6c8, phContext=0x18e754, pTargetName=0x270e480, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2711a7c, Reserved2=0x0, phNewContext=0x2710aa8, pOutput=0x2711a90, pfContextAttr=0x270f390, ptsExpiry=0x18e6c0 | out: phNewContext=0x2710aa8, pOutput=0x2711a90, pfContextAttr=0x270f390, ptsExpiry=0x18e6c0) returned 0x90312 [0164.817] recv (in: s=0x39c, buf=0x2711b20, len=5, flags=0 | out: buf=0x2711b20*) returned 5 [0164.818] recv (in: s=0x39c, buf=0x2711b39, len=4, flags=0 | out: buf=0x2711b39*) returned 4 [0164.818] InitializeSecurityContextW (in: phCredential=0x18e630, phContext=0x18e6bc, pTargetName=0x270e480, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2711bb0, Reserved2=0x0, phNewContext=0x2710aa8, pOutput=0x2711bc4, pfContextAttr=0x270f390, ptsExpiry=0x18e628 | out: phNewContext=0x2710aa8, pOutput=0x2711bc4, pfContextAttr=0x270f390, ptsExpiry=0x18e628) returned 0x90312 [0164.833] FreeContextBuffer (in: pvContextBuffer=0xfddc98 | out: pvContextBuffer=0xfddc98) returned 0x0 [0164.833] send (s=0x39c, buf=0x2711c40*, len=126, flags=0) returned 126 [0164.834] recv (in: s=0x39c, buf=0x2711c40, len=5, flags=0 | out: buf=0x2711c40*) returned 5 [0164.841] recv (in: s=0x39c, buf=0x2711ce5, len=202, flags=0 | out: buf=0x2711ce5*) returned 202 [0164.841] InitializeSecurityContextW (in: phCredential=0x18e598, phContext=0x18e624, pTargetName=0x270e480, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2711e20, Reserved2=0x0, phNewContext=0x2710aa8, pOutput=0x2711e34, pfContextAttr=0x270f390, ptsExpiry=0x18e590 | out: phNewContext=0x2710aa8, pOutput=0x2711e34, pfContextAttr=0x270f390, ptsExpiry=0x18e590) returned 0x90312 [0164.841] recv (in: s=0x39c, buf=0x2711ec4, len=5, flags=0 | out: buf=0x2711ec4*) returned 5 [0164.842] recv (in: s=0x39c, buf=0x2711edd, len=1, flags=0 | out: buf=0x2711edd*) returned 1 [0164.842] InitializeSecurityContextW (in: phCredential=0x18e500, phContext=0x18e58c, pTargetName=0x270e480, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2711f50, Reserved2=0x0, phNewContext=0x2710aa8, pOutput=0x2711f64, pfContextAttr=0x270f390, ptsExpiry=0x18e4f8 | out: phNewContext=0x2710aa8, pOutput=0x2711f64, pfContextAttr=0x270f390, ptsExpiry=0x18e4f8) returned 0x90312 [0164.842] recv (in: s=0x39c, buf=0x2711ff4, len=5, flags=0 | out: buf=0x2711ff4*) returned 5 [0164.842] recv (in: s=0x39c, buf=0x271200d, len=40, flags=0 | out: buf=0x271200d*) returned 40 [0164.842] InitializeSecurityContextW (in: phCredential=0x18e468, phContext=0x18e4f4, pTargetName=0x270e480, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x27120a8, Reserved2=0x0, phNewContext=0x2710aa8, pOutput=0x27120bc, pfContextAttr=0x270f390, ptsExpiry=0x18e460 | out: phNewContext=0x2710aa8, pOutput=0x27120bc, pfContextAttr=0x270f390, ptsExpiry=0x18e460) returned 0x0 [0164.917] QueryContextAttributesW (in: phContext=0x2710aa8, ulAttribute=0x4, pBuffer=0x2712168 | out: pBuffer=0x2712168) returned 0x0 [0164.918] QueryContextAttributesW (in: phContext=0x2710aa8, ulAttribute=0x5a, pBuffer=0x27121c0 | out: pBuffer=0x27121c0) returned 0x0 [0164.920] QueryContextAttributesW (in: phContext=0x2710aa8, ulAttribute=0x53, pBuffer=0x2712474 | out: pBuffer=0x2712474) returned 0x0 [0164.926] CertDuplicateCertificateContext (pCertContext=0x103bcd8) returned 0x103bcd8 [0164.927] CertDuplicateStore (hCertStore=0xfd9670) returned 0xfd9670 [0164.927] CertEnumCertificatesInStore (hCertStore=0xfd9670, pPrevCertContext=0x0) returned 0x1001418 [0164.928] CertDuplicateCertificateContext (pCertContext=0x1001418) returned 0x1001418 [0164.928] CertEnumCertificatesInStore (hCertStore=0xfd9670, pPrevCertContext=0x1001418) returned 0x103bcd8 [0164.928] CertDuplicateCertificateContext (pCertContext=0x103bcd8) returned 0x103bcd8 [0164.928] CertEnumCertificatesInStore (hCertStore=0xfd9670, pPrevCertContext=0x103bcd8) returned 0x0 [0164.928] CertCloseStore (hCertStore=0xfd9670, dwFlags=0x0) returned 1 [0164.928] CertFreeCertificateContext (pCertContext=0x103bcd8) returned 1 [0164.943] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0xfd9328 [0164.947] CertAddCRLLinkToStore (in: hCertStore=0xfd9328, pCrlContext=0x1001418, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0164.948] CertAddCRLLinkToStore (in: hCertStore=0xfd9328, pCrlContext=0x103bcd8, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0164.953] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x103bcd8, pTime=0x18e474, hAdditionalStore=0xfd9328, pChainPara=0x18e3b4, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x18e3a8 | out: ppChainContext=0x18e3a8) returned 1 [0164.965] CertDuplicateCertificateChain (pChainContext=0x1055aa0) returned 0x1055aa0 [0164.966] CertDuplicateCertificateContext (pCertContext=0x103bcd8) returned 0x103bcd8 [0164.966] CertDuplicateCertificateContext (pCertContext=0x1001198) returned 0x1001198 [0164.966] CertDuplicateCertificateContext (pCertContext=0x1000ce8) returned 0x1000ce8 [0164.966] CertFreeCertificateChain (pChainContext=0x1055aa0) [0164.966] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x1055aa0, pPolicyPara=0x18e554, pPolicyStatus=0x18e540 | out: pPolicyStatus=0x18e540) returned 1 [0164.967] SetLastError (dwErrCode=0x0) [0164.969] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x1055aa0, pPolicyPara=0x18e5c0, pPolicyStatus=0x18e568 | out: pPolicyStatus=0x18e568) returned 1 [0164.993] CertFreeCertificateChain (pChainContext=0x1055aa0) [0164.993] CertFreeCertificateContext (pCertContext=0x103bcd8) returned 1 [0164.997] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x18e27c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0164.997] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x18e27c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0164.997] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x18e27c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0164.997] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x18e27c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0164.998] EncryptMessage (in: phContext=0x2710aa8, fQOP=0x0, pMessage=0x271a310, MessageSeqNo=0x0 | out: pMessage=0x271a310) returned 0x0 [0164.998] send (s=0x39c, buf=0x2718de8*, len=416, flags=0) returned 416 [0165.002] select (in: nfds=0, readfds=0x271a3b4, writefds=0x0, exceptfds=0x0, timeout=0x18eb7c*(tv_sec=0, tv_usec=350000) | out: readfds=0x271a3b4, writefds=0x0, exceptfds=0x0) returned 1 [0165.007] setsockopt (s=0x39c, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0165.008] recv (in: s=0x39c, buf=0x27265d4, len=5, flags=0 | out: buf=0x27265d4*) returned 5 [0165.008] recv (in: s=0x39c, buf=0x27265d9, len=49, flags=0 | out: buf=0x27265d9*) returned 49 [0165.009] DecryptMessage (in: phContext=0x2710aa8, pMessage=0x272a694, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x272a694, pfQOP=0x0) returned 0x0 [0165.009] EncryptMessage (in: phContext=0x2710aa8, fQOP=0x0, pMessage=0x272a8b0, MessageSeqNo=0x0 | out: pMessage=0x272a8b0) returned 0x0 [0165.009] send (s=0x39c, buf=0x2718de8*, len=1202, flags=0) returned 1202 [0165.010] recv (in: s=0x39c, buf=0x27265d4, len=5, flags=0 | out: buf=0x27265d4*) returned 5 [0165.157] recv (in: s=0x39c, buf=0x27265d9, len=1393, flags=0 | out: buf=0x27265d9*) returned 1393 [0165.157] DecryptMessage (in: phContext=0x2710aa8, pMessage=0x272a9ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x272a9ec, pfQOP=0x0) returned 0x0 [0165.158] recv (in: s=0x39c, buf=0x27265d4, len=5, flags=0 | out: buf=0x27265d4*) returned 5 [0165.158] recv (in: s=0x39c, buf=0x27265d9, len=277, flags=0 | out: buf=0x27265d9*) returned 277 [0165.158] DecryptMessage (in: phContext=0x2710aa8, pMessage=0x272bf40, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x272bf40, pfQOP=0x0) returned 0x0 [0165.213] setsockopt (s=0x39c, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 Thread: id = 7 os_tid = 0xffc Thread: id = 11 os_tid = 0x1224 Thread: id = 12 os_tid = 0x11b8 [0145.286] CoGetContextToken (in: pToken=0xbdf834 | out: pToken=0xbdf834) returned 0x800401f0 [0145.286] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0145.286] RoInitialize () returned 0x1 [0145.286] RoUninitialize () returned 0x0 [0159.753] CoGetContextToken (in: pToken=0xbdf820 | out: pToken=0xbdf820) returned 0x0 [0159.754] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.754] WbemLocator:IUnknown:Release (This=0xfdc460) returned 0x1 [0159.754] WbemLocator:IUnknown:Release (This=0xfdc460) returned 0x0 [0159.754] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.754] WbemLocator:IUnknown:Release (This=0xfdc320) returned 0x1 [0159.754] WbemLocator:IUnknown:Release (This=0xfdc320) returned 0x0 [0159.754] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.754] WbemLocator:IUnknown:Release (This=0x100fcc8) returned 0x1 [0159.754] WbemLocator:IUnknown:Release (This=0x100fcc8) returned 0x0 [0159.754] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.754] WbemLocator:IUnknown:Release (This=0x100fac8) returned 0x1 [0159.754] WbemLocator:IUnknown:Release (This=0x100fac8) returned 0x0 [0159.754] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.754] WbemLocator:IUnknown:Release (This=0x100faf8) returned 0x1 [0159.754] WbemLocator:IUnknown:Release (This=0x100faf8) returned 0x0 [0159.754] CoGetContextToken (in: pToken=0xbdf820 | out: pToken=0xbdf820) returned 0x0 [0159.754] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.754] WbemDefPath:IUnknown:Release (This=0xfbae38) returned 0x1 [0159.754] WbemDefPath:IUnknown:Release (This=0xfbae38) returned 0x0 [0159.754] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.755] WbemDefPath:IUnknown:Release (This=0xffdc30) returned 0x1 [0159.755] WbemDefPath:IUnknown:Release (This=0xffdc30) returned 0x0 [0159.755] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.755] WbemDefPath:IUnknown:Release (This=0xffdae0) returned 0x1 [0159.755] WbemDefPath:IUnknown:Release (This=0xffdae0) returned 0x0 [0159.755] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.755] WbemDefPath:IUnknown:Release (This=0xffd7d0) returned 0x1 [0159.755] WbemDefPath:IUnknown:Release (This=0xffd7d0) returned 0x0 [0159.755] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.755] WbemDefPath:IUnknown:Release (This=0xffda70) returned 0x1 [0159.755] WbemDefPath:IUnknown:Release (This=0xffda70) returned 0x0 [0159.755] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.755] WbemDefPath:IUnknown:Release (This=0xffda00) returned 0x1 [0159.755] WbemDefPath:IUnknown:Release (This=0xffda00) returned 0x0 [0159.755] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.755] WbemDefPath:IUnknown:Release (This=0xffdb50) returned 0x1 [0159.755] WbemDefPath:IUnknown:Release (This=0xffdb50) returned 0x0 [0159.755] CoGetContextToken (in: pToken=0xbdf7a0 | out: pToken=0xbdf7a0) returned 0x0 [0159.755] WbemDefPath:IUnknown:Release (This=0xffd760) returned 0x1 [0159.755] WbemDefPath:IUnknown:Release (This=0xffd760) returned 0x0 [0159.755] CoGetContextToken (in: pToken=0xbdf820 | out: pToken=0xbdf820) returned 0x0 [0159.756] IUnknown:QueryInterface (in: This=0xfb2138, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xbdf7c4 | out: ppvObject=0xbdf7c4*=0xfb2148) returned 0x0 [0159.756] CObjectContext::ContextCallback () returned 0x0 [0161.133] IUnknown:Release (This=0xfb2148) returned 0x1 [0161.133] CoGetContextToken (in: pToken=0xbdf668 | out: pToken=0xbdf668) returned 0x0 [0161.133] IUnknown:QueryInterface (in: This=0xfb2138, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xbdf60c | out: ppvObject=0xbdf60c*=0xfb2148) returned 0x0 [0161.133] CObjectContext::ContextCallback () returned 0x0 [0161.154] IUnknown:Release (This=0xfb2148) returned 0x1 [0161.155] CoGetContextToken (in: pToken=0xbdf668 | out: pToken=0xbdf668) returned 0x0 [0161.155] IUnknown:QueryInterface (in: This=0xfb2138, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xbdf60c | out: ppvObject=0xbdf60c*=0xfb2148) returned 0x0 [0161.155] CObjectContext::ContextCallback () returned 0x0 [0161.181] IUnknown:Release (This=0xfb2148) returned 0x1 [0161.181] IUnknown:Release (This=0x102d760) returned 0x0 [0161.183] IUnknown:Release (This=0x100ed50) returned 0x0 [0161.184] CoGetContextToken (in: pToken=0xbdf668 | out: pToken=0xbdf668) returned 0x0 [0161.184] IUnknown:QueryInterface (in: This=0xfb2138, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xbdf60c | out: ppvObject=0xbdf60c*=0xfb2148) returned 0x0 [0161.184] CObjectContext::ContextCallback () returned 0x0 [0161.193] IUnknown:Release (This=0xfb2148) returned 0x1 [0161.193] IUnknown:Release (This=0x10037d8) returned 0x0 [0161.196] IUnknown:Release (This=0x1002cd0) returned 0x0 [0161.196] IUnknown:Release (This=0x1037128) returned 0x0 [0161.196] CoGetContextToken (in: pToken=0xbdf668 | out: pToken=0xbdf668) returned 0x0 [0161.196] IUnknown:QueryInterface (in: This=0xfb2138, riid=0x6f23da0c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xbdf60c | out: ppvObject=0xbdf60c*=0xfb2148) returned 0x0 [0161.197] CObjectContext::ContextCallback () returned 0x0 [0161.203] IUnknown:Release (This=0xfb2148) returned 0x1 [0161.203] IUnknown:Release (This=0xfb2138) returned 0x0 [0161.203] IUnknown:Release (This=0xffd3f0) returned 0x0 [0161.203] IUnknown:Release (This=0x1054290) returned 0x0 [0161.204] RegCloseKey (hKey=0x648) returned 0x0 [0161.204] CloseHandle (hObject=0x464) returned 1 [0161.204] CloseHandle (hObject=0x250) returned 1 [0161.204] CloseHandle (hObject=0x24c) returned 1 [0161.205] CloseHandle (hObject=0x38c) returned 1 [0161.205] CloseHandle (hObject=0x248) returned 1 [0161.205] CloseHandle (hObject=0x388) returned 1 [0161.205] CloseHandle (hObject=0x2fc) returned 1 [0161.206] CloseHandle (hObject=0x244) returned 1 [0161.208] CloseHandle (hObject=0x460) returned 1 [0161.208] CloseHandle (hObject=0x490) returned 1 [0161.208] CloseHandle (hObject=0x594) returned 1 [0161.209] CloseHandle (hObject=0x45c) returned 1 [0161.209] CloseHandle (hObject=0x48c) returned 1 [0161.209] CloseHandle (hObject=0x458) returned 1 [0161.209] CloseHandle (hObject=0x488) returned 1 [0161.210] CloseHandle (hObject=0x590) returned 1 [0161.210] CloseHandle (hObject=0x484) returned 1 [0161.210] CloseHandle (hObject=0x608) returned 1 [0161.210] CloseHandle (hObject=0x454) returned 1 [0161.210] CloseHandle (hObject=0x480) returned 1 [0161.210] CloseHandle (hObject=0x43c) returned 1 [0161.211] CloseHandle (hObject=0x430) returned 1 [0161.211] CloseHandle (hObject=0x578) returned 1 [0161.211] CloseHandle (hObject=0x42c) returned 1 [0161.211] CloseHandle (hObject=0x47c) returned 1 [0161.211] CloseHandle (hObject=0x620) returned 1 [0161.212] CloseHandle (hObject=0x478) returned 1 [0161.212] CloseHandle (hObject=0x574) returned 1 [0161.212] CloseHandle (hObject=0x428) returned 1 [0161.212] CloseHandle (hObject=0x470) returned 1 [0161.213] CloseHandle (hObject=0x410) returned 1 [0161.213] CloseHandle (hObject=0x40c) returned 1 [0161.213] CloseHandle (hObject=0x604) returned 1 [0161.213] CloseHandle (hObject=0x408) returned 1 [0161.214] CloseHandle (hObject=0x468) returned 1 [0161.214] CloseHandle (hObject=0x260) returned 1 [0161.214] CloseHandle (hObject=0x25c) returned 1 [0161.215] CloseHandle (hObject=0x258) returned 1 [0161.215] CloseHandle (hObject=0x404) returned 1 [0161.215] CloseHandle (hObject=0x254) returned 1 [0161.215] RegCloseKey (hKey=0x644) returned 0x0 [0161.216] RegCloseKey (hKey=0x640) returned 0x0 Thread: id = 13 os_tid = 0x6b8 [0149.401] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0149.401] RoInitialize () returned 0x1 [0149.401] RoUninitialize () returned 0x0 [0149.432] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x4aeedcc | out: lpiid=0x4aeedcc) returned 0x0 [0149.465] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0xfdc3d0) returned 0x0 [0149.547] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdc3d0, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0149.547] WbemDefPath:IClassFactory:CreateInstance (in: This=0xfdc3d0, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xfbae38) returned 0x0 [0149.548] WbemDefPath:IUnknown:Release (This=0xfdc3d0) returned 0x0 [0149.548] WbemDefPath:IUnknown:QueryInterface (in: This=0xfbae38, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xfbae38) returned 0x0 [0149.549] WbemDefPath:IUnknown:QueryInterface (in: This=0xfbae38, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0149.549] WbemDefPath:IUnknown:QueryInterface (in: This=0xfbae38, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0149.549] WbemDefPath:IUnknown:AddRef (This=0xfbae38) returned 0x3 [0149.549] WbemDefPath:IUnknown:QueryInterface (in: This=0xfbae38, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0149.549] WbemDefPath:IUnknown:QueryInterface (in: This=0xfbae38, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0149.549] WbemDefPath:IUnknown:QueryInterface (in: This=0xfbae38, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0xfe02c8) returned 0x0 [0149.549] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xfe02c8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.549] WbemDefPath:IUnknown:Release (This=0xfe02c8) returned 0x3 [0149.549] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0149.551] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0149.551] WbemDefPath:IUnknown:QueryInterface (in: This=0xfbae38, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0149.551] WbemDefPath:IUnknown:Release (This=0xfbae38) returned 0x2 [0149.551] WbemDefPath:IUnknown:Release (This=0xfbae38) returned 0x1 [0149.551] SetEvent (hEvent=0x2fc) returned 1 [0149.568] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0xfdc350) returned 0x0 [0149.568] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdc350, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0149.568] WbemDefPath:IClassFactory:CreateInstance (in: This=0xfdc350, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xfc1f50) returned 0x0 [0149.568] WbemDefPath:IUnknown:Release (This=0xfdc350) returned 0x0 [0149.568] WbemDefPath:IUnknown:QueryInterface (in: This=0xfc1f50, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xfc1f50) returned 0x0 [0149.568] WbemDefPath:IUnknown:QueryInterface (in: This=0xfc1f50, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0149.568] WbemDefPath:IUnknown:QueryInterface (in: This=0xfc1f50, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0149.568] WbemDefPath:IUnknown:AddRef (This=0xfc1f50) returned 0x3 [0149.568] WbemDefPath:IUnknown:QueryInterface (in: This=0xfc1f50, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0149.568] WbemDefPath:IUnknown:QueryInterface (in: This=0xfc1f50, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0149.568] WbemDefPath:IUnknown:QueryInterface (in: This=0xfc1f50, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0xfebf00) returned 0x0 [0149.568] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xfebf00, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.569] WbemDefPath:IUnknown:Release (This=0xfebf00) returned 0x3 [0149.569] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0149.569] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0149.569] WbemDefPath:IUnknown:QueryInterface (in: This=0xfc1f50, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0149.569] WbemDefPath:IUnknown:Release (This=0xfc1f50) returned 0x2 [0149.569] WbemDefPath:IUnknown:Release (This=0xfc1f50) returned 0x1 [0149.569] SetEvent (hEvent=0x388) returned 1 [0149.571] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0xfdc460) returned 0x0 [0149.571] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdc460, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0149.571] WbemDefPath:IClassFactory:CreateInstance (in: This=0xfdc460, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xfdbb90) returned 0x0 [0149.571] WbemDefPath:IUnknown:Release (This=0xfdc460) returned 0x0 [0149.571] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdbb90, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xfdbb90) returned 0x0 [0149.571] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdbb90, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0149.571] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdbb90, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0149.571] WbemDefPath:IUnknown:AddRef (This=0xfdbb90) returned 0x3 [0149.571] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdbb90, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0149.571] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdbb90, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0149.571] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdbb90, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0xfec0e0) returned 0x0 [0149.571] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xfec0e0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0149.571] WbemDefPath:IUnknown:Release (This=0xfec0e0) returned 0x3 [0149.572] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0149.572] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0149.572] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdbb90, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0149.572] WbemDefPath:IUnknown:Release (This=0xfdbb90) returned 0x2 [0149.572] WbemDefPath:IUnknown:Release (This=0xfdbb90) returned 0x1 [0149.572] SetEvent (hEvent=0x38c) returned 1 [0153.021] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0xfdc4a0) returned 0x0 [0153.021] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdc4a0, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0153.021] WbemDefPath:IClassFactory:CreateInstance (in: This=0xfdc4a0, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffd610) returned 0x0 [0153.021] WbemDefPath:IUnknown:Release (This=0xfdc4a0) returned 0x0 [0153.021] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd610, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffd610) returned 0x0 [0153.021] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd610, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0153.021] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd610, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0153.022] WbemDefPath:IUnknown:AddRef (This=0xffd610) returned 0x3 [0153.022] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd610, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0153.022] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd610, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0153.022] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd610, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0xfeecb8) returned 0x0 [0153.022] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xfeecb8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.022] WbemDefPath:IUnknown:Release (This=0xfeecb8) returned 0x3 [0153.022] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0153.022] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0153.022] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd610, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0153.022] WbemDefPath:IUnknown:Release (This=0xffd610) returned 0x2 [0153.022] WbemDefPath:IUnknown:Release (This=0xffd610) returned 0x1 [0153.022] SetEvent (hEvent=0x404) returned 1 [0153.181] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0xfdc350) returned 0x0 [0153.181] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdc350, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0153.181] WbemDefPath:IClassFactory:CreateInstance (in: This=0xfdc350, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffdbc0) returned 0x0 [0153.181] WbemDefPath:IUnknown:Release (This=0xfdc350) returned 0x0 [0153.181] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdbc0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffdbc0) returned 0x0 [0153.181] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdbc0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0153.181] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdbc0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0153.181] WbemDefPath:IUnknown:AddRef (This=0xffdbc0) returned 0x3 [0153.181] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdbc0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0153.182] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdbc0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0153.182] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdbc0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0xfeec88) returned 0x0 [0153.182] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xfeec88, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.182] WbemDefPath:IUnknown:Release (This=0xfeec88) returned 0x3 [0153.182] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0153.182] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0153.182] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdbc0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0153.182] WbemDefPath:IUnknown:Release (This=0xffdbc0) returned 0x2 [0153.182] WbemDefPath:IUnknown:Release (This=0xffdbc0) returned 0x1 [0153.182] SetEvent (hEvent=0x408) returned 1 [0153.247] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0xfdc350) returned 0x0 [0153.248] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdc350, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0153.248] WbemDefPath:IClassFactory:CreateInstance (in: This=0xfdc350, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffdc30) returned 0x0 [0153.248] WbemDefPath:IUnknown:Release (This=0xfdc350) returned 0x0 [0153.248] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdc30, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffdc30) returned 0x0 [0153.248] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdc30, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0153.248] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdc30, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0153.248] WbemDefPath:IUnknown:AddRef (This=0xffdc30) returned 0x3 [0153.248] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdc30, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0153.248] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdc30, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0153.248] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdc30, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0xfeedd8) returned 0x0 [0153.248] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xfeedd8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.248] WbemDefPath:IUnknown:Release (This=0xfeedd8) returned 0x3 [0153.248] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0153.249] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0153.249] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdc30, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0153.249] WbemDefPath:IUnknown:Release (This=0xffdc30) returned 0x2 [0153.249] WbemDefPath:IUnknown:Release (This=0xffdc30) returned 0x1 [0153.249] SetEvent (hEvent=0x40c) returned 1 [0153.252] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0xfdc320) returned 0x0 [0153.252] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdc320, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0153.252] WbemDefPath:IClassFactory:CreateInstance (in: This=0xfdc320, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffd680) returned 0x0 [0153.252] WbemDefPath:IUnknown:Release (This=0xfdc320) returned 0x0 [0153.252] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd680, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffd680) returned 0x0 [0153.252] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd680, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0153.252] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd680, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0153.252] WbemDefPath:IUnknown:AddRef (This=0xffd680) returned 0x3 [0153.252] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd680, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0153.252] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd680, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0153.252] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd680, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0xfef1f8) returned 0x0 [0153.253] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xfef1f8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.253] WbemDefPath:IUnknown:Release (This=0xfef1f8) returned 0x3 [0153.253] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0153.253] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0153.253] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd680, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0153.253] WbemDefPath:IUnknown:Release (This=0xffd680) returned 0x2 [0153.253] WbemDefPath:IUnknown:Release (This=0xffd680) returned 0x1 [0153.253] SetEvent (hEvent=0x410) returned 1 [0153.396] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0xfc10b8) returned 0x0 [0153.396] WbemDefPath:IUnknown:QueryInterface (in: This=0xfc10b8, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0153.397] WbemDefPath:IClassFactory:CreateInstance (in: This=0xfc10b8, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffdca0) returned 0x0 [0153.397] WbemDefPath:IUnknown:Release (This=0xfc10b8) returned 0x0 [0153.397] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdca0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffdca0) returned 0x0 [0153.397] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdca0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0153.397] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdca0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0153.397] WbemDefPath:IUnknown:AddRef (This=0xffdca0) returned 0x3 [0153.397] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdca0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0153.397] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdca0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0153.397] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdca0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0xfec1e8) returned 0x0 [0153.397] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0xfec1e8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.397] WbemDefPath:IUnknown:Release (This=0xfec1e8) returned 0x3 [0153.397] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0153.398] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0153.398] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdca0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0153.398] WbemDefPath:IUnknown:Release (This=0xffdca0) returned 0x2 [0153.398] WbemDefPath:IUnknown:Release (This=0xffdca0) returned 0x1 [0153.398] SetEvent (hEvent=0x428) returned 1 [0157.144] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fb88) returned 0x0 [0157.144] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fb88, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0157.144] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fb88, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffdd10) returned 0x0 [0157.144] WbemDefPath:IUnknown:Release (This=0x100fb88) returned 0x0 [0157.145] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd10, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffdd10) returned 0x0 [0157.145] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd10, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0157.145] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd10, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0157.145] WbemDefPath:IUnknown:AddRef (This=0xffdd10) returned 0x3 [0157.145] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd10, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0157.145] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd10, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0157.145] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd10, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x100f438) returned 0x0 [0157.145] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x100f438, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.145] WbemDefPath:IUnknown:Release (This=0x100f438) returned 0x3 [0157.145] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0157.145] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0157.145] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd10, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0157.146] WbemDefPath:IUnknown:Release (This=0xffdd10) returned 0x2 [0157.146] WbemDefPath:IUnknown:Release (This=0xffdd10) returned 0x1 [0157.146] SetEvent (hEvent=0x42c) returned 1 [0157.197] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0xfdc350) returned 0x0 [0157.198] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdc350, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0157.198] WbemDefPath:IClassFactory:CreateInstance (in: This=0xfdc350, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffdae0) returned 0x0 [0157.198] WbemDefPath:IUnknown:Release (This=0xfdc350) returned 0x0 [0157.198] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdae0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffdae0) returned 0x0 [0157.198] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdae0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0157.198] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdae0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0157.198] WbemDefPath:IUnknown:AddRef (This=0xffdae0) returned 0x3 [0157.198] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdae0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0157.198] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdae0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0157.198] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdae0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x100f2e8) returned 0x0 [0157.198] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x100f2e8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.198] WbemDefPath:IUnknown:Release (This=0x100f2e8) returned 0x3 [0157.198] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0157.198] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0157.198] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdae0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0157.198] WbemDefPath:IUnknown:Release (This=0xffdae0) returned 0x2 [0157.199] WbemDefPath:IUnknown:Release (This=0xffdae0) returned 0x1 [0157.199] SetEvent (hEvent=0x430) returned 1 [0157.209] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fe18) returned 0x0 [0157.209] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fe18, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0157.209] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fe18, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffdd80) returned 0x0 [0157.210] WbemDefPath:IUnknown:Release (This=0x100fe18) returned 0x0 [0157.210] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd80, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffdd80) returned 0x0 [0157.210] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd80, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0157.210] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd80, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0157.210] WbemDefPath:IUnknown:AddRef (This=0xffdd80) returned 0x3 [0157.210] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd80, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0157.210] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd80, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0157.210] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd80, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x100f600) returned 0x0 [0157.210] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x100f600, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.210] WbemDefPath:IUnknown:Release (This=0x100f600) returned 0x3 [0157.210] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0157.210] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0157.210] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdd80, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0157.210] WbemDefPath:IUnknown:Release (This=0xffdd80) returned 0x2 [0157.210] WbemDefPath:IUnknown:Release (This=0xffdd80) returned 0x1 [0157.210] SetEvent (hEvent=0x43c) returned 1 [0157.306] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fda8) returned 0x0 [0157.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fda8, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0157.306] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fda8, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffd990) returned 0x0 [0157.306] WbemDefPath:IUnknown:Release (This=0x100fda8) returned 0x0 [0157.306] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd990, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffd990) returned 0x0 [0157.307] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd990, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0157.307] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd990, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0157.307] WbemDefPath:IUnknown:AddRef (This=0xffd990) returned 0x3 [0157.307] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd990, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0157.307] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd990, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0157.307] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd990, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x100f210) returned 0x0 [0157.307] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x100f210, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.307] WbemDefPath:IUnknown:Release (This=0x100f210) returned 0x3 [0157.307] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0157.307] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0157.307] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd990, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0157.307] WbemDefPath:IUnknown:Release (This=0xffd990) returned 0x2 [0157.307] WbemDefPath:IUnknown:Release (This=0xffd990) returned 0x1 [0157.307] SetEvent (hEvent=0x454) returned 1 [0157.646] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fe68) returned 0x0 [0157.646] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fe68, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0157.646] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fe68, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffd7d0) returned 0x0 [0157.646] WbemDefPath:IUnknown:Release (This=0x100fe68) returned 0x0 [0157.646] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd7d0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffd7d0) returned 0x0 [0157.646] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd7d0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0157.646] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd7d0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0157.647] WbemDefPath:IUnknown:AddRef (This=0xffd7d0) returned 0x3 [0157.647] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd7d0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0157.647] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd7d0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0157.647] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd7d0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x100f138) returned 0x0 [0157.647] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x100f138, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.647] WbemDefPath:IUnknown:Release (This=0x100f138) returned 0x3 [0157.647] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0157.647] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0157.647] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd7d0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0157.647] WbemDefPath:IUnknown:Release (This=0xffd7d0) returned 0x2 [0157.647] WbemDefPath:IUnknown:Release (This=0xffd7d0) returned 0x1 [0157.647] SetEvent (hEvent=0x458) returned 1 [0157.661] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fd28) returned 0x0 [0157.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fd28, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0157.661] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fd28, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffda70) returned 0x0 [0157.661] WbemDefPath:IUnknown:Release (This=0x100fd28) returned 0x0 [0157.661] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda70, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffda70) returned 0x0 [0157.662] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda70, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0157.662] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda70, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0157.662] WbemDefPath:IUnknown:AddRef (This=0xffda70) returned 0x3 [0157.662] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda70, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0157.662] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda70, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0157.662] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda70, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x102e400) returned 0x0 [0157.662] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x102e400, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.662] WbemDefPath:IUnknown:Release (This=0x102e400) returned 0x3 [0157.662] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0157.662] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0157.662] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda70, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0157.662] WbemDefPath:IUnknown:Release (This=0xffda70) returned 0x2 [0157.662] WbemDefPath:IUnknown:Release (This=0xffda70) returned 0x1 [0157.663] SetEvent (hEvent=0x45c) returned 1 [0157.671] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fd28) returned 0x0 [0157.671] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fd28, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0157.671] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fd28, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffda00) returned 0x0 [0157.671] WbemDefPath:IUnknown:Release (This=0x100fd28) returned 0x0 [0157.671] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda00, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffda00) returned 0x0 [0157.671] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda00, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0157.671] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda00, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0157.671] WbemDefPath:IUnknown:AddRef (This=0xffda00) returned 0x3 [0157.671] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda00, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0157.672] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda00, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0157.672] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda00, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x102e2c8) returned 0x0 [0157.672] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x102e2c8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.672] WbemDefPath:IUnknown:Release (This=0x102e2c8) returned 0x3 [0157.672] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0157.672] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0157.672] WbemDefPath:IUnknown:QueryInterface (in: This=0xffda00, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0157.672] WbemDefPath:IUnknown:Release (This=0xffda00) returned 0x2 [0157.672] WbemDefPath:IUnknown:Release (This=0xffda00) returned 0x1 [0157.672] SetEvent (hEvent=0x460) returned 1 [0157.678] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fe68) returned 0x0 [0157.678] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fe68, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0157.678] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fe68, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffdb50) returned 0x0 [0157.678] WbemDefPath:IUnknown:Release (This=0x100fe68) returned 0x0 [0157.678] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdb50, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffdb50) returned 0x0 [0157.679] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdb50, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0157.679] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdb50, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0157.679] WbemDefPath:IUnknown:AddRef (This=0xffdb50) returned 0x3 [0157.679] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdb50, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0157.679] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdb50, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0157.679] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdb50, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x102e4f0) returned 0x0 [0157.679] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x102e4f0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.679] WbemDefPath:IUnknown:Release (This=0x102e4f0) returned 0x3 [0157.679] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0157.679] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0157.679] WbemDefPath:IUnknown:QueryInterface (in: This=0xffdb50, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0157.679] WbemDefPath:IUnknown:Release (This=0xffdb50) returned 0x2 [0157.679] WbemDefPath:IUnknown:Release (This=0xffdb50) returned 0x1 [0157.679] SetEvent (hEvent=0x464) returned 1 [0157.687] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fe28) returned 0x0 [0157.687] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fe28, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0157.687] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fe28, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0xffd760) returned 0x0 [0157.687] WbemDefPath:IUnknown:Release (This=0x100fe28) returned 0x0 [0157.687] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd760, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0xffd760) returned 0x0 [0157.687] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd760, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0157.687] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd760, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0157.688] WbemDefPath:IUnknown:AddRef (This=0xffd760) returned 0x3 [0157.688] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd760, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0157.688] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd760, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0157.688] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd760, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x102e058) returned 0x0 [0157.688] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x102e058, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.688] WbemDefPath:IUnknown:Release (This=0x102e058) returned 0x3 [0157.688] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0157.688] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0157.688] WbemDefPath:IUnknown:QueryInterface (in: This=0xffd760, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0157.688] WbemDefPath:IUnknown:Release (This=0xffd760) returned 0x2 [0157.688] WbemDefPath:IUnknown:Release (This=0xffd760) returned 0x1 [0157.688] SetEvent (hEvent=0x468) returned 1 [0159.109] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fbd8) returned 0x0 [0159.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fbd8, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0159.109] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fbd8, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0x1037a60) returned 0x0 [0159.109] WbemDefPath:IUnknown:Release (This=0x100fbd8) returned 0x0 [0159.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037a60, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0x1037a60) returned 0x0 [0159.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037a60, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0159.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037a60, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0159.110] WbemDefPath:IUnknown:AddRef (This=0x1037a60) returned 0x3 [0159.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037a60, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0159.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037a60, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0159.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037a60, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x1030400) returned 0x0 [0159.110] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1030400, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.110] WbemDefPath:IUnknown:Release (This=0x1030400) returned 0x3 [0159.110] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0159.110] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0159.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037a60, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0159.110] WbemDefPath:IUnknown:Release (This=0x1037a60) returned 0x2 [0159.110] WbemDefPath:IUnknown:Release (This=0x1037a60) returned 0x1 [0159.110] SetEvent (hEvent=0x604) returned 1 [0159.121] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fc78) returned 0x0 [0159.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fc78, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0159.121] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fc78, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0x1038390) returned 0x0 [0159.121] WbemDefPath:IUnknown:Release (This=0x100fc78) returned 0x0 [0159.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038390, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0x1038390) returned 0x0 [0159.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038390, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0159.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038390, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0159.122] WbemDefPath:IUnknown:AddRef (This=0x1038390) returned 0x3 [0159.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038390, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0159.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038390, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0159.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038390, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x1053318) returned 0x0 [0159.122] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1053318, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.122] WbemDefPath:IUnknown:Release (This=0x1053318) returned 0x3 [0159.122] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0159.122] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0159.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038390, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0159.122] WbemDefPath:IUnknown:Release (This=0x1038390) returned 0x2 [0159.122] WbemDefPath:IUnknown:Release (This=0x1038390) returned 0x1 [0159.122] SetEvent (hEvent=0x608) returned 1 [0159.333] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fc38) returned 0x0 [0159.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fc38, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0159.334] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fc38, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0x1037750) returned 0x0 [0159.334] WbemDefPath:IUnknown:Release (This=0x100fc38) returned 0x0 [0159.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037750, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0x1037750) returned 0x0 [0159.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037750, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0159.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037750, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0159.334] WbemDefPath:IUnknown:AddRef (This=0x1037750) returned 0x3 [0159.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037750, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0159.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037750, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0159.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037750, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x1053438) returned 0x0 [0159.335] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1053438, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.335] WbemDefPath:IUnknown:Release (This=0x1053438) returned 0x3 [0159.335] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0159.335] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0159.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037750, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0159.335] WbemDefPath:IUnknown:Release (This=0x1037750) returned 0x2 [0159.335] WbemDefPath:IUnknown:Release (This=0x1037750) returned 0x1 [0159.335] SetEvent (hEvent=0x620) returned 1 [0161.130] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fb98) returned 0x0 [0161.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fb98, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0161.131] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fb98, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0x1037600) returned 0x0 [0161.131] WbemDefPath:IUnknown:Release (This=0x100fb98) returned 0x0 [0161.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037600, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0x1037600) returned 0x0 [0161.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037600, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0161.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037600, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0161.131] WbemDefPath:IUnknown:AddRef (This=0x1037600) returned 0x3 [0161.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037600, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0161.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037600, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0161.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037600, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x1053210) returned 0x0 [0161.132] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1053210, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.132] WbemDefPath:IUnknown:Release (This=0x1053210) returned 0x3 [0161.132] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0161.132] CoGetContextToken (in: pToken=0x4aee1f8 | out: pToken=0x4aee1f8) returned 0x0 [0161.132] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0161.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037600, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0161.132] WbemDefPath:IUnknown:Release (This=0x1037600) returned 0x2 [0161.132] WbemDefPath:IUnknown:Release (This=0x1037600) returned 0x1 [0161.132] SetEvent (hEvent=0x65c) returned 1 [0161.420] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fc98) returned 0x0 [0161.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fc98, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0161.420] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fc98, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0x1037e50) returned 0x0 [0161.420] WbemDefPath:IUnknown:Release (This=0x100fc98) returned 0x0 [0161.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037e50, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0x1037e50) returned 0x0 [0161.421] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037e50, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0161.421] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037e50, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0161.421] WbemDefPath:IUnknown:AddRef (This=0x1037e50) returned 0x3 [0161.421] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037e50, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0161.421] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037e50, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0161.421] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037e50, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x1053948) returned 0x0 [0161.421] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1053948, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.421] WbemDefPath:IUnknown:Release (This=0x1053948) returned 0x3 [0161.421] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0161.421] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0161.421] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037e50, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0161.421] WbemDefPath:IUnknown:Release (This=0x1037e50) returned 0x2 [0161.421] WbemDefPath:IUnknown:Release (This=0x1037e50) returned 0x1 [0161.421] SetEvent (hEvent=0x618) returned 1 [0162.856] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fac8) returned 0x0 [0162.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0162.856] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fac8, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0x1038240) returned 0x0 [0162.856] WbemDefPath:IUnknown:Release (This=0x100fac8) returned 0x0 [0162.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038240, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0x1038240) returned 0x0 [0162.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038240, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0162.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038240, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0162.857] WbemDefPath:IUnknown:AddRef (This=0x1038240) returned 0x3 [0162.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038240, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0162.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038240, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0162.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038240, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x1052b08) returned 0x0 [0162.857] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1052b08, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.857] WbemDefPath:IUnknown:Release (This=0x1052b08) returned 0x3 [0162.857] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0162.857] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0162.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038240, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0162.857] WbemDefPath:IUnknown:Release (This=0x1038240) returned 0x2 [0162.857] WbemDefPath:IUnknown:Release (This=0x1038240) returned 0x1 [0162.857] SetEvent (hEvent=0x5f8) returned 1 [0162.933] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x100fba8) returned 0x0 [0162.934] WbemDefPath:IUnknown:QueryInterface (in: This=0x100fba8, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0162.934] WbemDefPath:IClassFactory:CreateInstance (in: This=0x100fba8, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0x1037bb0) returned 0x0 [0162.934] WbemDefPath:IUnknown:Release (This=0x100fba8) returned 0x0 [0162.934] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037bb0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0x1037bb0) returned 0x0 [0162.934] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037bb0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0162.934] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037bb0, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0162.934] WbemDefPath:IUnknown:AddRef (This=0x1037bb0) returned 0x3 [0162.934] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037bb0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0162.934] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037bb0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0162.934] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037bb0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x1052d78) returned 0x0 [0162.935] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1052d78, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.935] WbemDefPath:IUnknown:Release (This=0x1052d78) returned 0x3 [0162.935] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0162.935] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0162.935] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037bb0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0162.935] WbemDefPath:IUnknown:Release (This=0x1037bb0) returned 0x2 [0162.935] WbemDefPath:IUnknown:Release (This=0x1037bb0) returned 0x1 [0162.935] SetEvent (hEvent=0x5e4) returned 1 [0163.107] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0xfdc330) returned 0x0 [0163.107] WbemDefPath:IUnknown:QueryInterface (in: This=0xfdc330, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0163.107] WbemDefPath:IClassFactory:CreateInstance (in: This=0xfdc330, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0x1037830) returned 0x0 [0163.108] WbemDefPath:IUnknown:Release (This=0xfdc330) returned 0x0 [0163.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037830, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0x1037830) returned 0x0 [0163.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037830, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0163.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037830, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0163.108] WbemDefPath:IUnknown:AddRef (This=0x1037830) returned 0x3 [0163.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037830, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0163.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037830, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0163.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037830, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x1053048) returned 0x0 [0163.108] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1053048, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.108] WbemDefPath:IUnknown:Release (This=0x1053048) returned 0x3 [0163.108] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0163.108] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0163.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1037830, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0163.108] WbemDefPath:IUnknown:Release (This=0x1037830) returned 0x2 [0163.109] WbemDefPath:IUnknown:Release (This=0x1037830) returned 0x1 [0163.109] SetEvent (hEvent=0x440) returned 1 [0164.515] CoGetClassObject (in: rclsid=0xfda0dc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aeead8 | out: ppv=0x4aeead8*=0x10332b0) returned 0x0 [0164.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x10332b0, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4aeecf4 | out: ppvObject=0x4aeecf4*=0x0) returned 0x80004002 [0164.515] WbemDefPath:IClassFactory:CreateInstance (in: This=0x10332b0, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aeed00 | out: ppvObject=0x4aeed00*=0x1038320) returned 0x0 [0164.515] WbemDefPath:IUnknown:Release (This=0x10332b0) returned 0x0 [0164.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038320, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee924 | out: ppvObject=0x4aee924*=0x1038320) returned 0x0 [0164.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038320, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4aee8e0 | out: ppvObject=0x4aee8e0*=0x0) returned 0x80004002 [0164.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038320, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4aee4d4 | out: ppvObject=0x4aee4d4*=0x0) returned 0x80004002 [0164.515] WbemDefPath:IUnknown:AddRef (This=0x1038320) returned 0x3 [0164.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038320, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4aee234 | out: ppvObject=0x4aee234*=0x0) returned 0x80004002 [0164.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038320, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4aee1e4 | out: ppvObject=0x4aee1e4*=0x0) returned 0x80004002 [0164.515] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038320, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee1f0 | out: ppvObject=0x4aee1f0*=0x102e130) returned 0x0 [0164.516] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x102e130, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4aee1f8 | out: pCid=0x4aee1f8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0164.516] WbemDefPath:IUnknown:Release (This=0x102e130) returned 0x3 [0164.516] CoGetContextToken (in: pToken=0x4aee250 | out: pToken=0x4aee250) returned 0x0 [0164.516] CoGetContextToken (in: pToken=0x4aee658 | out: pToken=0x4aee658) returned 0x0 [0164.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1038320, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4aee6e4 | out: ppvObject=0x4aee6e4*=0x0) returned 0x80004002 [0164.516] WbemDefPath:IUnknown:Release (This=0x1038320) returned 0x2 [0164.516] WbemDefPath:IUnknown:Release (This=0x1038320) returned 0x1 [0164.516] SetEvent (hEvent=0x424) returned 1 Thread: id = 14 os_tid = 0xa18 Thread: id = 15 os_tid = 0x1390 Thread: id = 16 os_tid = 0x138c Thread: id = 17 os_tid = 0x1388 [0149.583] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0149.583] RoInitialize () returned 0x1 [0149.583] RoUninitialize () returned 0x0 [0149.583] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x4eef014 | out: lpiid=0x4eef014) returned 0x0 [0149.585] CoGetClassObject (in: rclsid=0xfda16c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4eeed20 | out: ppv=0x4eeed20*=0xfec1b8) returned 0x0 [0149.597] WbemLocator:IUnknown:QueryInterface (in: This=0xfec1b8, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4eeef3c | out: ppvObject=0x4eeef3c*=0x0) returned 0x80004002 [0149.597] WbemLocator:IClassFactory:CreateInstance (in: This=0xfec1b8, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eeef48 | out: ppvObject=0x4eeef48*=0xfdc460) returned 0x0 [0149.597] WbemLocator:IUnknown:Release (This=0xfec1b8) returned 0x0 [0149.597] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc460, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eeeb6c | out: ppvObject=0x4eeeb6c*=0xfdc460) returned 0x0 [0149.598] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc460, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4eeeb28 | out: ppvObject=0x4eeeb28*=0x0) returned 0x80004002 [0149.598] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc460, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4eee71c | out: ppvObject=0x4eee71c*=0x0) returned 0x80004002 [0149.598] WbemLocator:IUnknown:AddRef (This=0xfdc460) returned 0x3 [0149.598] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc460, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4eee47c | out: ppvObject=0x4eee47c*=0x0) returned 0x80004002 [0149.598] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc460, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4eee42c | out: ppvObject=0x4eee42c*=0x0) returned 0x80004002 [0149.598] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc460, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eee438 | out: ppvObject=0x4eee438*=0x0) returned 0x80004002 [0149.599] CoGetContextToken (in: pToken=0x4eee498 | out: pToken=0x4eee498) returned 0x0 [0149.599] CoGetObjectContext (in: riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0xfec234 | out: ppv=0xfec234*=0xfb21f0) returned 0x0 [0149.600] CoGetContextToken (in: pToken=0x4eee8a0 | out: pToken=0x4eee8a0) returned 0x0 [0149.600] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc460, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eee92c | out: ppvObject=0x4eee92c*=0x0) returned 0x80004002 [0149.601] WbemLocator:IUnknown:Release (This=0xfdc460) returned 0x2 [0149.601] WbemLocator:IUnknown:Release (This=0xfdc460) returned 0x1 [0149.601] CoGetContextToken (in: pToken=0x4eeef28 | out: pToken=0x4eeef28) returned 0x0 [0149.601] CoGetContextToken (in: pToken=0x4eeee88 | out: pToken=0x4eeee88) returned 0x0 [0149.601] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc460, riid=0x4eeef58*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x4eeef54 | out: ppvObject=0x4eeef54*=0xfdc460) returned 0x0 [0149.601] WbemLocator:IUnknown:AddRef (This=0xfdc460) returned 0x3 [0149.601] WbemLocator:IUnknown:Release (This=0xfdc460) returned 0x2 [0149.605] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfdbb90, puCount=0x4eef0ec | out: puCount=0x4eef0ec*=0x2) returned 0x0 [0149.605] WbemDefPath:IWbemPath:GetText (in: This=0xfdbb90, lFlags=8, puBuffLength=0x4eef0e8*=0x0, pszText=0x0 | out: puBuffLength=0x4eef0e8*=0xf, pszText=0x0) returned 0x0 [0149.605] WbemDefPath:IWbemPath:GetText (in: This=0xfdbb90, lFlags=8, puBuffLength=0x4eef0e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x4eef0e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0149.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x4eee320, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0149.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x4eee868, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0149.617] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6b3f0000 [0149.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x4eee89c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity VkgA­z(ú\x12ohëî\x04\x01", lpUsedDefaultChar=0x0) returned 13 [0149.631] GetProcAddress (hModule=0x6b3f0000, lpProcName="ResetSecurity") returned 0x6b3f2cc0 [0149.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x4eee89c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0149.640] GetProcAddress (hModule=0x6b3f0000, lpProcName="SetSecurity") returned 0x6b3f2d10 [0149.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x4eee898, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesVkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 18 [0149.651] GetProcAddress (hModule=0x6b3f0000, lpProcName="BlessIWbemServices") returned 0x6b3f2090 [0149.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x4eee890, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 24 [0149.686] GetProcAddress (hModule=0x6b3f0000, lpProcName="BlessIWbemServicesObject") returned 0x6b3f20f0 [0149.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x4eee898, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 17 [0149.723] GetProcAddress (hModule=0x6b3f0000, lpProcName="GetPropertyHandle") returned 0x6b3f27a0 [0149.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x4eee898, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueVkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 18 [0149.748] GetProcAddress (hModule=0x6b3f0000, lpProcName="WritePropertyValue") returned 0x6b3f2e50 [0149.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4eee8a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 5 [0149.761] GetProcAddress (hModule=0x6b3f0000, lpProcName="Clone") returned 0x6b3f2150 [0149.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x4eee898, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0149.770] GetProcAddress (hModule=0x6b3f0000, lpProcName="VerifyClientKey") returned 0x6b3f2e00 [0149.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x4eee898, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0149.775] GetProcAddress (hModule=0x6b3f0000, lpProcName="GetQualifierSet") returned 0x6b3f2860 [0149.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x4eee8a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0149.777] GetProcAddress (hModule=0x6b3f0000, lpProcName="Get") returned 0x6b3f2630 [0149.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x4eee8a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0149.798] GetProcAddress (hModule=0x6b3f0000, lpProcName="Put") returned 0x6b3f2970 [0149.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x4eee8a4, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteVkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 6 [0149.816] GetProcAddress (hModule=0x6b3f0000, lpProcName="Delete") returned 0x6b3f2410 [0149.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x4eee8a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 8 [0149.827] GetProcAddress (hModule=0x6b3f0000, lpProcName="GetNames") returned 0x6b3f2740 [0149.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x4eee898, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 16 [0149.877] GetProcAddress (hModule=0x6b3f0000, lpProcName="BeginEnumeration") returned 0x6b3f2050 [0149.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x4eee8a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 4 [0149.886] GetProcAddress (hModule=0x6b3f0000, lpProcName="Next") returned 0x6b3f2910 [0149.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x4eee89c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumerationVkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 14 [0149.902] GetProcAddress (hModule=0x6b3f0000, lpProcName="EndEnumeration") returned 0x6b3f24d0 [0149.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x4eee890, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0149.910] GetProcAddress (hModule=0x6b3f0000, lpProcName="GetPropertyQualifierSet") returned 0x6b3f2830 [0149.923] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4eee8a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 5 [0149.924] GetProcAddress (hModule=0x6b3f0000, lpProcName="Clone") returned 0x6b3f2150 [0149.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x4eee89c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 13 [0149.924] GetProcAddress (hModule=0x6b3f0000, lpProcName="GetObjectText") returned 0x6b3f2770 [0149.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x4eee898, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 17 [0149.937] GetProcAddress (hModule=0x6b3f0000, lpProcName="SpawnDerivedClass") returned 0x6b3f2d60 [0149.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x4eee89c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 13 [0149.946] GetProcAddress (hModule=0x6b3f0000, lpProcName="SpawnInstance") returned 0x6b3f2d90 [0149.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x4eee8a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 9 [0149.948] GetProcAddress (hModule=0x6b3f0000, lpProcName="CompareTo") returned 0x6b3f2200 [0149.966] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x4eee898, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 17 [0149.967] GetProcAddress (hModule=0x6b3f0000, lpProcName="GetPropertyOrigin") returned 0x6b3f2800 [0149.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x4eee89c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 12 [0149.982] GetProcAddress (hModule=0x6b3f0000, lpProcName="InheritsFrom") returned 0x6b3f2880 [0149.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x4eee8a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 9 [0149.984] GetProcAddress (hModule=0x6b3f0000, lpProcName="GetMethod") returned 0x6b3f26b0 [0149.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x4eee8a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 9 [0149.999] GetProcAddress (hModule=0x6b3f0000, lpProcName="PutMethod") returned 0x6b3f2ae0 [0150.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x4eee89c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 12 [0150.029] GetProcAddress (hModule=0x6b3f0000, lpProcName="DeleteMethod") returned 0x6b3f2430 [0150.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x4eee894, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumerationVkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 22 [0150.030] GetProcAddress (hModule=0x6b3f0000, lpProcName="BeginMethodEnumeration") returned 0x6b3f2070 [0150.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x4eee8a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodVkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 10 [0150.032] GetProcAddress (hModule=0x6b3f0000, lpProcName="NextMethod") returned 0x6b3f2940 [0150.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x4eee894, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 20 [0150.046] GetProcAddress (hModule=0x6b3f0000, lpProcName="EndMethodEnumeration") returned 0x6b3f24f0 [0150.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x4eee894, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 21 [0150.047] GetProcAddress (hModule=0x6b3f0000, lpProcName="GetMethodQualifierSet") returned 0x6b3f2710 [0150.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x4eee898, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0150.048] GetProcAddress (hModule=0x6b3f0000, lpProcName="GetMethodOrigin") returned 0x6b3f26e0 [0150.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x4eee898, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 16 [0150.050] GetProcAddress (hModule=0x6b3f0000, lpProcName="QualifierSet_Get") returned 0x6b3f2b70 [0150.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x4eee898, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 16 [0150.059] GetProcAddress (hModule=0x6b3f0000, lpProcName="QualifierSet_Put") returned 0x6b3f2c00 [0150.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x4eee894, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0150.064] GetProcAddress (hModule=0x6b3f0000, lpProcName="QualifierSet_Delete") returned 0x6b3f2b30 [0150.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x4eee894, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 21 [0150.066] GetProcAddress (hModule=0x6b3f0000, lpProcName="QualifierSet_GetNames") returned 0x6b3f2ba0 [0150.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x4eee88c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 29 [0150.089] GetProcAddress (hModule=0x6b3f0000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6b3f2b10 [0150.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x4eee898, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 17 [0150.090] GetProcAddress (hModule=0x6b3f0000, lpProcName="QualifierSet_Next") returned 0x6b3f2bd0 [0150.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x4eee88c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0150.099] GetProcAddress (hModule=0x6b3f0000, lpProcName="QualifierSet_EndEnumeration") returned 0x6b3f2b50 [0150.099] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x4eee890, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0150.100] GetProcAddress (hModule=0x6b3f0000, lpProcName="GetCurrentApartmentType") returned 0x6b3f2860 [0150.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x4eee894, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 20 [0150.102] GetProcAddress (hModule=0x6b3f0000, lpProcName="GetDemultiplexedStub") returned 0x6b3f2660 [0150.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x4eee894, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 21 [0150.107] GetProcAddress (hModule=0x6b3f0000, lpProcName="CreateInstanceEnumWmi") returned 0x6b3f2380 [0150.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x4eee898, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmiVkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 18 [0150.138] GetProcAddress (hModule=0x6b3f0000, lpProcName="CreateClassEnumWmi") returned 0x6b3f22f0 [0150.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x4eee89c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 12 [0150.139] GetProcAddress (hModule=0x6b3f0000, lpProcName="ExecQueryWmi") returned 0x6b3f25a0 [0150.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x4eee890, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 24 [0150.175] GetProcAddress (hModule=0x6b3f0000, lpProcName="ExecNotificationQueryWmi") returned 0x6b3f2510 [0150.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x4eee89c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmiVkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 14 [0150.177] GetProcAddress (hModule=0x6b3f0000, lpProcName="PutInstanceWmi") returned 0x6b3f2a40 [0150.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x4eee89c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0150.185] GetProcAddress (hModule=0x6b3f0000, lpProcName="PutClassWmi") returned 0x6b3f29a0 [0150.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x4eee890, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 24 [0150.186] GetProcAddress (hModule=0x6b3f0000, lpProcName="CloneEnumWbemClassObject") returned 0x6b3f2170 [0150.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x4eee898, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi´ VkgA­z(ú\x12ohëî\x04", lpUsedDefaultChar=0x0) returned 16 [0150.194] GetProcAddress (hModule=0x6b3f0000, lpProcName="ConnectServerWmi") returned 0x6b3f2230 [0150.202] CoCreateInstance (in: rclsid=0x6b3f13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6b3f1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4eeefc4 | out: ppv=0x4eeefc4*=0xfdc4a0) returned 0x0 [0150.202] WbemLocator:IWbemLocator:ConnectServer (in: This=0xfdc4a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x4eef058 | out: ppNamespace=0x4eef058*=0xfbbf10) returned 0x0 [0152.699] WbemLocator:IUnknown:QueryInterface (in: This=0xfbbf10, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eeeeec | out: ppvObject=0x4eeeeec*=0xff448c) returned 0x0 [0152.699] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff448c, pProxy=0xfbbf10, pAuthnSvc=0x4eeef3c, pAuthzSvc=0x4eeef38, pServerPrincName=0x4eeef30, pAuthnLevel=0x4eeef34, pImpLevel=0x4eeef24, pAuthInfo=0x4eeef28, pCapabilites=0x4eeef2c | out: pAuthnSvc=0x4eeef3c*=0xa, pAuthzSvc=0x4eeef38*=0x0, pServerPrincName=0x4eeef30, pAuthnLevel=0x4eeef34*=0x6, pImpLevel=0x4eeef24*=0x2, pAuthInfo=0x4eeef28, pCapabilites=0x4eeef2c*=0x1) returned 0x0 [0152.699] WbemLocator:IUnknown:Release (This=0xff448c) returned 0x1 [0152.699] WbemLocator:IUnknown:QueryInterface (in: This=0xfbbf10, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eeeee0 | out: ppvObject=0x4eeeee0*=0xff44b0) returned 0x0 [0152.699] WbemLocator:IUnknown:QueryInterface (in: This=0xfbbf10, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eeeecc | out: ppvObject=0x4eeeecc*=0xff448c) returned 0x0 [0152.699] WbemLocator:IClientSecurity:SetBlanket (This=0xff448c, pProxy=0xfbbf10, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0152.700] WbemLocator:IUnknown:Release (This=0xff448c) returned 0x2 [0152.700] WbemLocator:IUnknown:Release (This=0xff44b0) returned 0x1 [0152.700] CoTaskMemFree (pv=0xff2da8) [0152.700] WbemLocator:IUnknown:Release (This=0xfdc4a0) returned 0x0 [0152.700] WbemLocator:IUnknown:QueryInterface (in: This=0xfbbf10, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eeeadc | out: ppvObject=0x4eeeadc*=0xff44b0) returned 0x0 [0152.701] WbemLocator:IUnknown:QueryInterface (in: This=0xff44b0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4eeea98 | out: ppvObject=0x4eeea98*=0x0) returned 0x80004002 [0152.701] WbemLocator:IUnknown:QueryInterface (in: This=0xff44b0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4eee8b4 | out: ppvObject=0x4eee8b4*=0x0) returned 0x80004002 [0152.702] WbemLocator:IUnknown:QueryInterface (in: This=0xfbbf10, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4eee68c | out: ppvObject=0x4eee68c*=0x0) returned 0x80004002 [0152.702] WbemLocator:IUnknown:AddRef (This=0xff44b0) returned 0x3 [0152.702] WbemLocator:IUnknown:QueryInterface (in: This=0xff44b0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4eee3ec | out: ppvObject=0x4eee3ec*=0x0) returned 0x80004002 [0152.703] WbemLocator:IUnknown:QueryInterface (in: This=0xff44b0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4eee39c | out: ppvObject=0x4eee39c*=0x0) returned 0x80004002 [0152.703] WbemLocator:IUnknown:QueryInterface (in: This=0xff44b0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eee3a8 | out: ppvObject=0x4eee3a8*=0xff440c) returned 0x0 [0152.703] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff440c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4eee3b0 | out: pCid=0x4eee3b0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0152.703] WbemLocator:IUnknown:Release (This=0xff440c) returned 0x3 [0152.703] CoGetContextToken (in: pToken=0x4eee408 | out: pToken=0x4eee408) returned 0x0 [0152.704] CoGetContextToken (in: pToken=0x4eee810 | out: pToken=0x4eee810) returned 0x0 [0152.704] WbemLocator:IUnknown:QueryInterface (in: This=0xff44b0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4eee89c | out: ppvObject=0x4eee89c*=0xff4494) returned 0x0 [0152.704] WbemLocator:IRpcOptions:Query (in: This=0xff4494, pPrx=0xff44b0, dwProperty=2, pdwValue=0x4eee8a8 | out: pdwValue=0x4eee8a8) returned 0x80004002 [0152.704] WbemLocator:IUnknown:Release (This=0xff4494) returned 0x3 [0152.704] WbemLocator:IUnknown:Release (This=0xff44b0) returned 0x2 [0152.704] CoGetContextToken (in: pToken=0x4eeedf0 | out: pToken=0x4eeedf0) returned 0x0 [0152.704] CoGetContextToken (in: pToken=0x4eeed50 | out: pToken=0x4eeed50) returned 0x0 [0152.704] WbemLocator:IUnknown:QueryInterface (in: This=0xff44b0, riid=0x4eeee20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x4eeee1c | out: ppvObject=0x4eeee1c*=0xfbbf10) returned 0x0 [0152.704] WbemLocator:IUnknown:AddRef (This=0xfbbf10) returned 0x4 [0152.704] WbemLocator:IUnknown:Release (This=0xfbbf10) returned 0x3 [0152.705] WbemLocator:IUnknown:Release (This=0xfbbf10) returned 0x2 [0152.714] SysStringLen (param_1=0x0) returned 0x0 [0152.716] CoUninitialize () Thread: id = 128 os_tid = 0x1350 [0152.823] CoGetContextToken (in: pToken=0x4eeee8c | out: pToken=0x4eeee8c) returned 0x0 [0152.823] CoGetContextToken (in: pToken=0x4eeee7c | out: pToken=0x4eeee7c) returned 0x0 [0152.824] CoGetMarshalSizeMax (in: pulSize=0x4eeee38, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff44b0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4eeee38) returned 0x0 [0152.825] CoMarshalInterface (pStm=0xff27a0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff44b0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0153.366] CoGetContextToken (in: pToken=0x4eeee8c | out: pToken=0x4eeee8c) returned 0x0 [0153.366] CoGetContextToken (in: pToken=0x4eeee7c | out: pToken=0x4eeee7c) returned 0x0 [0153.366] CoGetMarshalSizeMax (in: pulSize=0x4eeee38, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff94c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4eeee38) returned 0x0 [0153.367] CoMarshalInterface (pStm=0xff2480, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff94c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0157.252] CoGetContextToken (in: pToken=0x4eeee8c | out: pToken=0x4eeee8c) returned 0x0 [0157.252] CoGetContextToken (in: pToken=0x4eeee7c | out: pToken=0x4eeee7c) returned 0x0 [0157.252] CoGetMarshalSizeMax (in: pulSize=0x4eeee38, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff97c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4eeee38) returned 0x0 [0157.253] CoMarshalInterface (pStm=0xff2800, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff97c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0158.971] CoGetContextToken (in: pToken=0x4eeee8c | out: pToken=0x4eeee8c) returned 0x0 [0158.971] CoGetContextToken (in: pToken=0x4eeee7c | out: pToken=0x4eeee7c) returned 0x0 [0158.971] CoGetMarshalSizeMax (in: pulSize=0x4eeee38, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xffa2c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4eeee38) returned 0x0 [0158.971] CoMarshalInterface (pStm=0xff29a0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xffa2c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0159.168] CoGetContextToken (in: pToken=0x4eeee8c | out: pToken=0x4eeee8c) returned 0x0 [0159.168] CoGetContextToken (in: pToken=0x4eeee7c | out: pToken=0x4eeee7c) returned 0x0 [0159.168] CoGetMarshalSizeMax (in: pulSize=0x4eeee38, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xffa3c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4eeee38) returned 0x0 [0159.168] CoMarshalInterface (pStm=0xff2740, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xffa3c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0161.222] CoGetContextToken (in: pToken=0x4eeee8c | out: pToken=0x4eeee8c) returned 0x0 [0161.222] CoGetContextToken (in: pToken=0x4eeee7c | out: pToken=0x4eeee7c) returned 0x0 [0161.222] CoGetMarshalSizeMax (in: pulSize=0x4eeee38, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xffabc0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4eeee38) returned 0x0 [0161.222] CoMarshalInterface (pStm=0xff2900, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xffabc0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0161.561] CoGetContextToken (in: pToken=0x4eeee8c | out: pToken=0x4eeee8c) returned 0x0 [0161.561] CoGetContextToken (in: pToken=0x4eeee7c | out: pToken=0x4eeee7c) returned 0x0 [0161.561] CoGetMarshalSizeMax (in: pulSize=0x4eeee38, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff8ec0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4eeee38) returned 0x0 [0161.562] CoMarshalInterface (pStm=0xff2a60, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff8ec0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0162.974] CoGetContextToken (in: pToken=0x4eeee8c | out: pToken=0x4eeee8c) returned 0x0 [0162.974] CoGetContextToken (in: pToken=0x4eeee7c | out: pToken=0x4eeee7c) returned 0x0 [0162.974] CoGetMarshalSizeMax (in: pulSize=0x4eeee38, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff91c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4eeee38) returned 0x0 [0162.975] CoMarshalInterface (pStm=0xff2a80, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0xff91c0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0163.151] CoGetContextToken (in: pToken=0x4eeee8c | out: pToken=0x4eeee8c) returned 0x0 [0163.151] CoGetContextToken (in: pToken=0x4eeee7c | out: pToken=0x4eeee7c) returned 0x0 [0163.151] CoGetMarshalSizeMax (in: pulSize=0x4eeee38, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x101af30, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4eeee38) returned 0x0 [0163.152] CoMarshalInterface (pStm=0xff2ba0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x101af30, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 Thread: id = 131 os_tid = 0x134c [0153.272] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0153.272] RoInitialize () returned 0x1 [0153.272] RoUninitialize () returned 0x0 [0153.273] CoGetClassObject (in: rclsid=0xfda16c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4feefa0 | out: ppv=0x4feefa0*=0xfeefd0) returned 0x0 [0153.274] WbemLocator:IUnknown:QueryInterface (in: This=0xfeefd0, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4fef1bc | out: ppvObject=0x4fef1bc*=0x0) returned 0x80004002 [0153.274] WbemLocator:IClassFactory:CreateInstance (in: This=0xfeefd0, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fef1c8 | out: ppvObject=0x4fef1c8*=0xfdc320) returned 0x0 [0153.274] WbemLocator:IUnknown:Release (This=0xfeefd0) returned 0x0 [0153.274] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc320, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4feedec | out: ppvObject=0x4feedec*=0xfdc320) returned 0x0 [0153.274] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc320, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4feeda8 | out: ppvObject=0x4feeda8*=0x0) returned 0x80004002 [0153.274] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc320, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4fee99c | out: ppvObject=0x4fee99c*=0x0) returned 0x80004002 [0153.274] WbemLocator:IUnknown:AddRef (This=0xfdc320) returned 0x3 [0153.274] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc320, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4fee6fc | out: ppvObject=0x4fee6fc*=0x0) returned 0x80004002 [0153.274] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc320, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4fee6ac | out: ppvObject=0x4fee6ac*=0x0) returned 0x80004002 [0153.275] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc320, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fee6b8 | out: ppvObject=0x4fee6b8*=0x0) returned 0x80004002 [0153.275] CoGetContextToken (in: pToken=0x4fee718 | out: pToken=0x4fee718) returned 0x0 [0153.275] CoGetContextToken (in: pToken=0x4feeb20 | out: pToken=0x4feeb20) returned 0x0 [0153.275] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc320, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4feebac | out: ppvObject=0x4feebac*=0x0) returned 0x80004002 [0153.275] WbemLocator:IUnknown:Release (This=0xfdc320) returned 0x2 [0153.275] WbemLocator:IUnknown:Release (This=0xfdc320) returned 0x1 [0153.276] CoGetContextToken (in: pToken=0x4fef1a8 | out: pToken=0x4fef1a8) returned 0x0 [0153.276] CoGetContextToken (in: pToken=0x4fef108 | out: pToken=0x4fef108) returned 0x0 [0153.276] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc320, riid=0x4fef1d8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x4fef1d4 | out: ppvObject=0x4fef1d4*=0xfdc320) returned 0x0 [0153.276] WbemLocator:IUnknown:AddRef (This=0xfdc320) returned 0x3 [0153.276] WbemLocator:IUnknown:Release (This=0xfdc320) returned 0x2 [0153.276] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffd680, puCount=0x4fef36c | out: puCount=0x4fef36c*=0x2) returned 0x0 [0153.276] WbemDefPath:IWbemPath:GetText (in: This=0xffd680, lFlags=8, puBuffLength=0x4fef368*=0x0, pszText=0x0 | out: puBuffLength=0x4fef368*=0xf, pszText=0x0) returned 0x0 [0153.276] WbemDefPath:IWbemPath:GetText (in: This=0xffd680, lFlags=8, puBuffLength=0x4fef368*=0xf, pszText="00000000000000" | out: puBuffLength=0x4fef368*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0153.276] CoCreateInstance (in: rclsid=0x6b3f13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6b3f1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4fef244 | out: ppv=0x4fef244*=0xfdc350) returned 0x0 [0153.276] WbemLocator:IWbemLocator:ConnectServer (in: This=0xfdc350, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x4fef2d8 | out: ppNamespace=0x4fef2d8*=0x1000e88) returned 0x0 [0153.351] WbemLocator:IUnknown:QueryInterface (in: This=0x1000e88, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fef16c | out: ppvObject=0x4fef16c*=0xff949c) returned 0x0 [0153.352] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff949c, pProxy=0x1000e88, pAuthnSvc=0x4fef1bc, pAuthzSvc=0x4fef1b8, pServerPrincName=0x4fef1b0, pAuthnLevel=0x4fef1b4, pImpLevel=0x4fef1a4, pAuthInfo=0x4fef1a8, pCapabilites=0x4fef1ac | out: pAuthnSvc=0x4fef1bc*=0xa, pAuthzSvc=0x4fef1b8*=0x0, pServerPrincName=0x4fef1b0, pAuthnLevel=0x4fef1b4*=0x6, pImpLevel=0x4fef1a4*=0x2, pAuthInfo=0x4fef1a8, pCapabilites=0x4fef1ac*=0x1) returned 0x0 [0153.352] WbemLocator:IUnknown:Release (This=0xff949c) returned 0x1 [0153.352] WbemLocator:IUnknown:QueryInterface (in: This=0x1000e88, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fef160 | out: ppvObject=0x4fef160*=0xff94c0) returned 0x0 [0153.352] WbemLocator:IUnknown:QueryInterface (in: This=0x1000e88, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fef14c | out: ppvObject=0x4fef14c*=0xff949c) returned 0x0 [0153.352] WbemLocator:IClientSecurity:SetBlanket (This=0xff949c, pProxy=0x1000e88, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0153.352] WbemLocator:IUnknown:Release (This=0xff949c) returned 0x2 [0153.352] WbemLocator:IUnknown:Release (This=0xff94c0) returned 0x1 [0153.352] CoTaskMemFree (pv=0xff2d78) [0153.352] WbemLocator:IUnknown:Release (This=0xfdc350) returned 0x0 [0153.353] WbemLocator:IUnknown:QueryInterface (in: This=0x1000e88, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4feed5c | out: ppvObject=0x4feed5c*=0xff94c0) returned 0x0 [0153.353] WbemLocator:IUnknown:QueryInterface (in: This=0xff94c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4feed18 | out: ppvObject=0x4feed18*=0x0) returned 0x80004002 [0153.353] WbemLocator:IUnknown:QueryInterface (in: This=0xff94c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4feeb34 | out: ppvObject=0x4feeb34*=0x0) returned 0x80004002 [0153.354] WbemLocator:IUnknown:QueryInterface (in: This=0x1000e88, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4fee90c | out: ppvObject=0x4fee90c*=0x0) returned 0x80004002 [0153.354] WbemLocator:IUnknown:AddRef (This=0xff94c0) returned 0x3 [0153.354] WbemLocator:IUnknown:QueryInterface (in: This=0xff94c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4fee66c | out: ppvObject=0x4fee66c*=0x0) returned 0x80004002 [0153.354] WbemLocator:IUnknown:QueryInterface (in: This=0xff94c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4fee61c | out: ppvObject=0x4fee61c*=0x0) returned 0x80004002 [0153.354] WbemLocator:IUnknown:QueryInterface (in: This=0xff94c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fee628 | out: ppvObject=0x4fee628*=0xff941c) returned 0x0 [0153.355] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff941c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4fee630 | out: pCid=0x4fee630*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.355] WbemLocator:IUnknown:Release (This=0xff941c) returned 0x3 [0153.355] CoGetContextToken (in: pToken=0x4fee688 | out: pToken=0x4fee688) returned 0x0 [0153.355] CoGetContextToken (in: pToken=0x4feea90 | out: pToken=0x4feea90) returned 0x0 [0153.355] WbemLocator:IUnknown:QueryInterface (in: This=0xff94c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4feeb1c | out: ppvObject=0x4feeb1c*=0xff94a4) returned 0x0 [0153.355] WbemLocator:IRpcOptions:Query (in: This=0xff94a4, pPrx=0xff94c0, dwProperty=2, pdwValue=0x4feeb28 | out: pdwValue=0x4feeb28) returned 0x80004002 [0153.355] WbemLocator:IUnknown:Release (This=0xff94a4) returned 0x3 [0153.355] WbemLocator:IUnknown:Release (This=0xff94c0) returned 0x2 [0153.355] CoGetContextToken (in: pToken=0x4fef070 | out: pToken=0x4fef070) returned 0x0 [0153.355] CoGetContextToken (in: pToken=0x4feefd0 | out: pToken=0x4feefd0) returned 0x0 [0153.355] WbemLocator:IUnknown:QueryInterface (in: This=0xff94c0, riid=0x4fef0a0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x4fef09c | out: ppvObject=0x4fef09c*=0x1000e88) returned 0x0 [0153.355] WbemLocator:IUnknown:AddRef (This=0x1000e88) returned 0x4 [0153.355] WbemLocator:IUnknown:Release (This=0x1000e88) returned 0x3 [0153.355] WbemLocator:IUnknown:Release (This=0x1000e88) returned 0x2 [0153.355] SysStringLen (param_1=0x0) returned 0x0 [0153.356] CoUninitialize () Thread: id = 156 os_tid = 0x13bc [0157.217] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0157.217] RoInitialize () returned 0x1 [0157.217] RoUninitialize () returned 0x0 [0157.218] CoGetClassObject (in: rclsid=0xfda16c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4feec60 | out: ppv=0x4feec60*=0x100f5d0) returned 0x0 [0157.218] WbemLocator:IUnknown:QueryInterface (in: This=0x100f5d0, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4feee7c | out: ppvObject=0x4feee7c*=0x0) returned 0x80004002 [0157.218] WbemLocator:IClassFactory:CreateInstance (in: This=0x100f5d0, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4feee88 | out: ppvObject=0x4feee88*=0x100fcc8) returned 0x0 [0157.218] WbemLocator:IUnknown:Release (This=0x100f5d0) returned 0x0 [0157.218] WbemLocator:IUnknown:QueryInterface (in: This=0x100fcc8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4feeaac | out: ppvObject=0x4feeaac*=0x100fcc8) returned 0x0 [0157.218] WbemLocator:IUnknown:QueryInterface (in: This=0x100fcc8, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4feea68 | out: ppvObject=0x4feea68*=0x0) returned 0x80004002 [0157.218] WbemLocator:IUnknown:QueryInterface (in: This=0x100fcc8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4fee65c | out: ppvObject=0x4fee65c*=0x0) returned 0x80004002 [0157.219] WbemLocator:IUnknown:AddRef (This=0x100fcc8) returned 0x3 [0157.219] WbemLocator:IUnknown:QueryInterface (in: This=0x100fcc8, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4fee3bc | out: ppvObject=0x4fee3bc*=0x0) returned 0x80004002 [0157.219] WbemLocator:IUnknown:QueryInterface (in: This=0x100fcc8, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4fee36c | out: ppvObject=0x4fee36c*=0x0) returned 0x80004002 [0157.219] WbemLocator:IUnknown:QueryInterface (in: This=0x100fcc8, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fee378 | out: ppvObject=0x4fee378*=0x0) returned 0x80004002 [0157.219] CoGetContextToken (in: pToken=0x4fee3d8 | out: pToken=0x4fee3d8) returned 0x0 [0157.220] CoGetContextToken (in: pToken=0x4fee7e0 | out: pToken=0x4fee7e0) returned 0x0 [0157.220] WbemLocator:IUnknown:QueryInterface (in: This=0x100fcc8, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fee86c | out: ppvObject=0x4fee86c*=0x0) returned 0x80004002 [0157.220] WbemLocator:IUnknown:Release (This=0x100fcc8) returned 0x2 [0157.220] WbemLocator:IUnknown:Release (This=0x100fcc8) returned 0x1 [0157.220] CoGetContextToken (in: pToken=0x4feee68 | out: pToken=0x4feee68) returned 0x0 [0157.220] CoGetContextToken (in: pToken=0x4feedc8 | out: pToken=0x4feedc8) returned 0x0 [0157.220] WbemLocator:IUnknown:QueryInterface (in: This=0x100fcc8, riid=0x4feee98*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x4feee94 | out: ppvObject=0x4feee94*=0x100fcc8) returned 0x0 [0157.220] WbemLocator:IUnknown:AddRef (This=0x100fcc8) returned 0x3 [0157.220] WbemLocator:IUnknown:Release (This=0x100fcc8) returned 0x2 [0157.220] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xffdd80, puCount=0x4fef02c | out: puCount=0x4fef02c*=0x2) returned 0x0 [0157.220] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=8, puBuffLength=0x4fef028*=0x0, pszText=0x0 | out: puBuffLength=0x4fef028*=0xf, pszText=0x0) returned 0x0 [0157.220] WbemDefPath:IWbemPath:GetText (in: This=0xffdd80, lFlags=8, puBuffLength=0x4fef028*=0xf, pszText="00000000000000" | out: puBuffLength=0x4fef028*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0157.220] CoCreateInstance (in: rclsid=0x6b3f13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6b3f1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4feef04 | out: ppv=0x4feef04*=0x100fdd8) returned 0x0 [0157.221] WbemLocator:IWbemLocator:ConnectServer (in: This=0x100fdd8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x4feef98 | out: ppNamespace=0x4feef98*=0x1001298) returned 0x0 [0157.245] WbemLocator:IUnknown:QueryInterface (in: This=0x1001298, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4feee2c | out: ppvObject=0x4feee2c*=0xff979c) returned 0x0 [0157.245] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff979c, pProxy=0x1001298, pAuthnSvc=0x4feee7c, pAuthzSvc=0x4feee78, pServerPrincName=0x4feee70, pAuthnLevel=0x4feee74, pImpLevel=0x4feee64, pAuthInfo=0x4feee68, pCapabilites=0x4feee6c | out: pAuthnSvc=0x4feee7c*=0xa, pAuthzSvc=0x4feee78*=0x0, pServerPrincName=0x4feee70, pAuthnLevel=0x4feee74*=0x6, pImpLevel=0x4feee64*=0x2, pAuthInfo=0x4feee68, pCapabilites=0x4feee6c*=0x1) returned 0x0 [0157.245] WbemLocator:IUnknown:Release (This=0xff979c) returned 0x1 [0157.245] WbemLocator:IUnknown:QueryInterface (in: This=0x1001298, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4feee20 | out: ppvObject=0x4feee20*=0xff97c0) returned 0x0 [0157.245] WbemLocator:IUnknown:QueryInterface (in: This=0x1001298, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4feee0c | out: ppvObject=0x4feee0c*=0xff979c) returned 0x0 [0157.246] WbemLocator:IClientSecurity:SetBlanket (This=0xff979c, pProxy=0x1001298, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.246] WbemLocator:IUnknown:Release (This=0xff979c) returned 0x2 [0157.246] WbemLocator:IUnknown:Release (This=0xff97c0) returned 0x1 [0157.246] CoTaskMemFree (pv=0xff3318) [0157.246] WbemLocator:IUnknown:Release (This=0x100fdd8) returned 0x0 [0157.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1001298, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4feea1c | out: ppvObject=0x4feea1c*=0xff97c0) returned 0x0 [0157.246] WbemLocator:IUnknown:QueryInterface (in: This=0xff97c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4fee9d8 | out: ppvObject=0x4fee9d8*=0x0) returned 0x80004002 [0157.247] WbemLocator:IUnknown:QueryInterface (in: This=0xff97c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4fee7f4 | out: ppvObject=0x4fee7f4*=0x0) returned 0x80004002 [0157.247] WbemLocator:IUnknown:QueryInterface (in: This=0x1001298, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4fee5cc | out: ppvObject=0x4fee5cc*=0x0) returned 0x80004002 [0157.247] WbemLocator:IUnknown:AddRef (This=0xff97c0) returned 0x3 [0157.247] WbemLocator:IUnknown:QueryInterface (in: This=0xff97c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4fee32c | out: ppvObject=0x4fee32c*=0x0) returned 0x80004002 [0157.247] WbemLocator:IUnknown:QueryInterface (in: This=0xff97c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4fee2dc | out: ppvObject=0x4fee2dc*=0x0) returned 0x80004002 [0157.247] WbemLocator:IUnknown:QueryInterface (in: This=0xff97c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fee2e8 | out: ppvObject=0x4fee2e8*=0xff971c) returned 0x0 [0157.248] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff971c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4fee2f0 | out: pCid=0x4fee2f0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.248] WbemLocator:IUnknown:Release (This=0xff971c) returned 0x3 [0157.248] CoGetContextToken (in: pToken=0x4fee348 | out: pToken=0x4fee348) returned 0x0 [0157.248] CoGetContextToken (in: pToken=0x4fee750 | out: pToken=0x4fee750) returned 0x0 [0157.248] WbemLocator:IUnknown:QueryInterface (in: This=0xff97c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4fee7dc | out: ppvObject=0x4fee7dc*=0xff97a4) returned 0x0 [0157.248] WbemLocator:IRpcOptions:Query (in: This=0xff97a4, pPrx=0xff97c0, dwProperty=2, pdwValue=0x4fee7e8 | out: pdwValue=0x4fee7e8) returned 0x80004002 [0157.248] WbemLocator:IUnknown:Release (This=0xff97a4) returned 0x3 [0157.248] WbemLocator:IUnknown:Release (This=0xff97c0) returned 0x2 [0157.248] CoGetContextToken (in: pToken=0x4feed30 | out: pToken=0x4feed30) returned 0x0 [0157.248] CoGetContextToken (in: pToken=0x4feec90 | out: pToken=0x4feec90) returned 0x0 [0157.249] WbemLocator:IUnknown:QueryInterface (in: This=0xff97c0, riid=0x4feed60*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x4feed5c | out: ppvObject=0x4feed5c*=0x1001298) returned 0x0 [0157.249] WbemLocator:IUnknown:AddRef (This=0x1001298) returned 0x4 [0157.249] WbemLocator:IUnknown:Release (This=0x1001298) returned 0x3 [0157.249] WbemLocator:IUnknown:Release (This=0x1001298) returned 0x2 [0157.249] SysStringLen (param_1=0x0) returned 0x0 [0157.249] CoUninitialize () Thread: id = 158 os_tid = 0x13b4 Thread: id = 159 os_tid = 0x13a8 [0158.201] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0158.201] RoInitialize () returned 0x1 [0158.201] RoUninitialize () returned 0x0 [0158.203] ResetEvent (hEvent=0x230) returned 1 Thread: id = 160 os_tid = 0x13b0 [0158.942] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0158.942] RoInitialize () returned 0x1 [0158.942] RoUninitialize () returned 0x0 [0158.943] CoGetClassObject (in: rclsid=0xfda16c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x52cf2e0 | out: ppv=0x52cf2e0*=0x1030460) returned 0x0 [0158.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1030460, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x52cf4fc | out: ppvObject=0x52cf4fc*=0x0) returned 0x80004002 [0158.943] WbemLocator:IClassFactory:CreateInstance (in: This=0x1030460, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cf508 | out: ppvObject=0x52cf508*=0x100fac8) returned 0x0 [0158.943] WbemLocator:IUnknown:Release (This=0x1030460) returned 0x0 [0158.943] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cf12c | out: ppvObject=0x52cf12c*=0x100fac8) returned 0x0 [0158.944] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x52cf0e8 | out: ppvObject=0x52cf0e8*=0x0) returned 0x80004002 [0158.944] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x52cecdc | out: ppvObject=0x52cecdc*=0x0) returned 0x80004002 [0158.944] WbemLocator:IUnknown:AddRef (This=0x100fac8) returned 0x3 [0158.944] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x52cea3c | out: ppvObject=0x52cea3c*=0x0) returned 0x80004002 [0158.944] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x52ce9ec | out: ppvObject=0x52ce9ec*=0x0) returned 0x80004002 [0158.944] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52ce9f8 | out: ppvObject=0x52ce9f8*=0x0) returned 0x80004002 [0158.944] CoGetContextToken (in: pToken=0x52cea58 | out: pToken=0x52cea58) returned 0x0 [0158.944] CoGetContextToken (in: pToken=0x52cee60 | out: pToken=0x52cee60) returned 0x0 [0158.944] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52ceeec | out: ppvObject=0x52ceeec*=0x0) returned 0x80004002 [0158.944] WbemLocator:IUnknown:Release (This=0x100fac8) returned 0x2 [0158.944] WbemLocator:IUnknown:Release (This=0x100fac8) returned 0x1 [0158.944] CoGetContextToken (in: pToken=0x52cf4e8 | out: pToken=0x52cf4e8) returned 0x0 [0158.944] CoGetContextToken (in: pToken=0x52cf448 | out: pToken=0x52cf448) returned 0x0 [0158.944] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x52cf518*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x52cf514 | out: ppvObject=0x52cf514*=0x100fac8) returned 0x0 [0158.945] WbemLocator:IUnknown:AddRef (This=0x100fac8) returned 0x3 [0158.945] WbemLocator:IUnknown:Release (This=0x100fac8) returned 0x2 [0158.945] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x52cf6ac | out: puCount=0x52cf6ac*=0x2) returned 0x0 [0158.945] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=8, puBuffLength=0x52cf6a8*=0x0, pszText=0x0 | out: puBuffLength=0x52cf6a8*=0xf, pszText=0x0) returned 0x0 [0158.945] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=8, puBuffLength=0x52cf6a8*=0xf, pszText="00000000000000" | out: puBuffLength=0x52cf6a8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0158.945] CoCreateInstance (in: rclsid=0x6b3f13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6b3f1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x52cf584 | out: ppv=0x52cf584*=0x100fb78) returned 0x0 [0158.945] WbemLocator:IWbemLocator:ConnectServer (in: This=0x100fb78, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x52cf618 | out: ppNamespace=0x52cf618*=0x103c238) returned 0x0 [0158.963] WbemLocator:IUnknown:QueryInterface (in: This=0x103c238, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cf4ac | out: ppvObject=0x52cf4ac*=0xffa29c) returned 0x0 [0158.963] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xffa29c, pProxy=0x103c238, pAuthnSvc=0x52cf4fc, pAuthzSvc=0x52cf4f8, pServerPrincName=0x52cf4f0, pAuthnLevel=0x52cf4f4, pImpLevel=0x52cf4e4, pAuthInfo=0x52cf4e8, pCapabilites=0x52cf4ec | out: pAuthnSvc=0x52cf4fc*=0xa, pAuthzSvc=0x52cf4f8*=0x0, pServerPrincName=0x52cf4f0, pAuthnLevel=0x52cf4f4*=0x6, pImpLevel=0x52cf4e4*=0x2, pAuthInfo=0x52cf4e8, pCapabilites=0x52cf4ec*=0x1) returned 0x0 [0158.963] WbemLocator:IUnknown:Release (This=0xffa29c) returned 0x1 [0158.963] WbemLocator:IUnknown:QueryInterface (in: This=0x103c238, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cf4a0 | out: ppvObject=0x52cf4a0*=0xffa2c0) returned 0x0 [0158.963] WbemLocator:IUnknown:QueryInterface (in: This=0x103c238, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cf48c | out: ppvObject=0x52cf48c*=0xffa29c) returned 0x0 [0158.963] WbemLocator:IClientSecurity:SetBlanket (This=0xffa29c, pProxy=0x103c238, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0158.964] WbemLocator:IUnknown:Release (This=0xffa29c) returned 0x2 [0158.964] WbemLocator:IUnknown:Release (This=0xffa2c0) returned 0x1 [0158.964] CoTaskMemFree (pv=0xfda520) [0158.964] WbemLocator:IUnknown:Release (This=0x100fb78) returned 0x0 [0158.964] WbemLocator:IUnknown:QueryInterface (in: This=0x103c238, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cf09c | out: ppvObject=0x52cf09c*=0xffa2c0) returned 0x0 [0158.964] WbemLocator:IUnknown:QueryInterface (in: This=0xffa2c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x52cf058 | out: ppvObject=0x52cf058*=0x0) returned 0x80004002 [0158.964] WbemLocator:IUnknown:QueryInterface (in: This=0xffa2c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x52cee74 | out: ppvObject=0x52cee74*=0x0) returned 0x80004002 [0158.965] WbemLocator:IUnknown:QueryInterface (in: This=0x103c238, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x52cec4c | out: ppvObject=0x52cec4c*=0x0) returned 0x80004002 [0158.965] WbemLocator:IUnknown:AddRef (This=0xffa2c0) returned 0x3 [0158.965] WbemLocator:IUnknown:QueryInterface (in: This=0xffa2c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x52ce9ac | out: ppvObject=0x52ce9ac*=0x0) returned 0x80004002 [0158.965] WbemLocator:IUnknown:QueryInterface (in: This=0xffa2c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x52ce95c | out: ppvObject=0x52ce95c*=0x0) returned 0x80004002 [0158.965] WbemLocator:IUnknown:QueryInterface (in: This=0xffa2c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52ce968 | out: ppvObject=0x52ce968*=0xffa21c) returned 0x0 [0158.965] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xffa21c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x52ce970 | out: pCid=0x52ce970*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0158.965] WbemLocator:IUnknown:Release (This=0xffa21c) returned 0x3 [0158.965] CoGetContextToken (in: pToken=0x52ce9c8 | out: pToken=0x52ce9c8) returned 0x0 [0158.966] CoGetContextToken (in: pToken=0x52cedd0 | out: pToken=0x52cedd0) returned 0x0 [0158.966] WbemLocator:IUnknown:QueryInterface (in: This=0xffa2c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cee5c | out: ppvObject=0x52cee5c*=0xffa2a4) returned 0x0 [0158.966] WbemLocator:IRpcOptions:Query (in: This=0xffa2a4, pPrx=0xffa2c0, dwProperty=2, pdwValue=0x52cee68 | out: pdwValue=0x52cee68) returned 0x80004002 [0158.966] WbemLocator:IUnknown:Release (This=0xffa2a4) returned 0x3 [0158.966] WbemLocator:IUnknown:Release (This=0xffa2c0) returned 0x2 [0158.966] CoGetContextToken (in: pToken=0x52cf3b0 | out: pToken=0x52cf3b0) returned 0x0 [0158.966] CoGetContextToken (in: pToken=0x52cf310 | out: pToken=0x52cf310) returned 0x0 [0158.966] WbemLocator:IUnknown:QueryInterface (in: This=0xffa2c0, riid=0x52cf3e0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x52cf3dc | out: ppvObject=0x52cf3dc*=0x103c238) returned 0x0 [0158.966] WbemLocator:IUnknown:AddRef (This=0x103c238) returned 0x4 [0158.966] WbemLocator:IUnknown:Release (This=0x103c238) returned 0x3 [0158.966] WbemLocator:IUnknown:Release (This=0x103c238) returned 0x2 [0158.966] SysStringLen (param_1=0x0) returned 0x0 [0158.967] CoUninitialize () Thread: id = 161 os_tid = 0x13ac [0159.128] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0159.128] RoInitialize () returned 0x1 [0159.128] RoUninitialize () returned 0x0 [0159.129] CoGetClassObject (in: rclsid=0xfda16c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x52cefc0 | out: ppv=0x52cefc0*=0x1053120) returned 0x0 [0159.129] WbemLocator:IUnknown:QueryInterface (in: This=0x1053120, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x52cf1dc | out: ppvObject=0x52cf1dc*=0x0) returned 0x80004002 [0159.129] WbemLocator:IClassFactory:CreateInstance (in: This=0x1053120, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cf1e8 | out: ppvObject=0x52cf1e8*=0x100faf8) returned 0x0 [0159.129] WbemLocator:IUnknown:Release (This=0x1053120) returned 0x0 [0159.129] WbemLocator:IUnknown:QueryInterface (in: This=0x100faf8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cee0c | out: ppvObject=0x52cee0c*=0x100faf8) returned 0x0 [0159.129] WbemLocator:IUnknown:QueryInterface (in: This=0x100faf8, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x52cedc8 | out: ppvObject=0x52cedc8*=0x0) returned 0x80004002 [0159.129] WbemLocator:IUnknown:QueryInterface (in: This=0x100faf8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x52ce9bc | out: ppvObject=0x52ce9bc*=0x0) returned 0x80004002 [0159.129] WbemLocator:IUnknown:AddRef (This=0x100faf8) returned 0x3 [0159.129] WbemLocator:IUnknown:QueryInterface (in: This=0x100faf8, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x52ce71c | out: ppvObject=0x52ce71c*=0x0) returned 0x80004002 [0159.129] WbemLocator:IUnknown:QueryInterface (in: This=0x100faf8, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x52ce6cc | out: ppvObject=0x52ce6cc*=0x0) returned 0x80004002 [0159.129] WbemLocator:IUnknown:QueryInterface (in: This=0x100faf8, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52ce6d8 | out: ppvObject=0x52ce6d8*=0x0) returned 0x80004002 [0159.129] CoGetContextToken (in: pToken=0x52ce738 | out: pToken=0x52ce738) returned 0x0 [0159.130] CoGetContextToken (in: pToken=0x52ceb40 | out: pToken=0x52ceb40) returned 0x0 [0159.130] WbemLocator:IUnknown:QueryInterface (in: This=0x100faf8, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cebcc | out: ppvObject=0x52cebcc*=0x0) returned 0x80004002 [0159.130] WbemLocator:IUnknown:Release (This=0x100faf8) returned 0x2 [0159.130] WbemLocator:IUnknown:Release (This=0x100faf8) returned 0x1 [0159.130] CoGetContextToken (in: pToken=0x52cf1c8 | out: pToken=0x52cf1c8) returned 0x0 [0159.130] CoGetContextToken (in: pToken=0x52cf128 | out: pToken=0x52cf128) returned 0x0 [0159.130] WbemLocator:IUnknown:QueryInterface (in: This=0x100faf8, riid=0x52cf1f8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x52cf1f4 | out: ppvObject=0x52cf1f4*=0x100faf8) returned 0x0 [0159.130] WbemLocator:IUnknown:AddRef (This=0x100faf8) returned 0x3 [0159.130] WbemLocator:IUnknown:Release (This=0x100faf8) returned 0x2 [0159.130] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1038390, puCount=0x52cf38c | out: puCount=0x52cf38c*=0x2) returned 0x0 [0159.130] WbemDefPath:IWbemPath:GetText (in: This=0x1038390, lFlags=8, puBuffLength=0x52cf388*=0x0, pszText=0x0 | out: puBuffLength=0x52cf388*=0xf, pszText=0x0) returned 0x0 [0159.130] WbemDefPath:IWbemPath:GetText (in: This=0x1038390, lFlags=8, puBuffLength=0x52cf388*=0xf, pszText="00000000000000" | out: puBuffLength=0x52cf388*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0159.130] CoCreateInstance (in: rclsid=0x6b3f13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6b3f1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x52cf264 | out: ppv=0x52cf264*=0x100fb78) returned 0x0 [0159.131] WbemLocator:IWbemLocator:ConnectServer (in: This=0x100fb78, strNetworkResource="\\\\.\\root\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x52cf2f8 | out: ppNamespace=0x52cf2f8*=0x103c288) returned 0x0 [0159.161] WbemLocator:IUnknown:QueryInterface (in: This=0x103c288, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cf18c | out: ppvObject=0x52cf18c*=0xffa39c) returned 0x0 [0159.162] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xffa39c, pProxy=0x103c288, pAuthnSvc=0x52cf1dc, pAuthzSvc=0x52cf1d8, pServerPrincName=0x52cf1d0, pAuthnLevel=0x52cf1d4, pImpLevel=0x52cf1c4, pAuthInfo=0x52cf1c8, pCapabilites=0x52cf1cc | out: pAuthnSvc=0x52cf1dc*=0xa, pAuthzSvc=0x52cf1d8*=0x0, pServerPrincName=0x52cf1d0, pAuthnLevel=0x52cf1d4*=0x6, pImpLevel=0x52cf1c4*=0x2, pAuthInfo=0x52cf1c8, pCapabilites=0x52cf1cc*=0x1) returned 0x0 [0159.162] WbemLocator:IUnknown:Release (This=0xffa39c) returned 0x1 [0159.162] WbemLocator:IUnknown:QueryInterface (in: This=0x103c288, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cf180 | out: ppvObject=0x52cf180*=0xffa3c0) returned 0x0 [0159.162] WbemLocator:IUnknown:QueryInterface (in: This=0x103c288, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52cf16c | out: ppvObject=0x52cf16c*=0xffa39c) returned 0x0 [0159.162] WbemLocator:IClientSecurity:SetBlanket (This=0xffa39c, pProxy=0x103c288, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0159.162] WbemLocator:IUnknown:Release (This=0xffa39c) returned 0x2 [0159.162] WbemLocator:IUnknown:Release (This=0xffa3c0) returned 0x1 [0159.162] CoTaskMemFree (pv=0xfda520) [0159.162] WbemLocator:IUnknown:Release (This=0x100fb78) returned 0x0 [0159.162] WbemLocator:IUnknown:QueryInterface (in: This=0x103c288, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52ced7c | out: ppvObject=0x52ced7c*=0xffa3c0) returned 0x0 [0159.162] WbemLocator:IUnknown:QueryInterface (in: This=0xffa3c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x52ced38 | out: ppvObject=0x52ced38*=0x0) returned 0x80004002 [0159.163] WbemLocator:IUnknown:QueryInterface (in: This=0xffa3c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x52ceb54 | out: ppvObject=0x52ceb54*=0x0) returned 0x80004002 [0159.163] WbemLocator:IUnknown:QueryInterface (in: This=0x103c288, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x52ce92c | out: ppvObject=0x52ce92c*=0x0) returned 0x80004002 [0159.164] WbemLocator:IUnknown:AddRef (This=0xffa3c0) returned 0x3 [0159.164] WbemLocator:IUnknown:QueryInterface (in: This=0xffa3c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x52ce68c | out: ppvObject=0x52ce68c*=0x0) returned 0x80004002 [0159.164] WbemLocator:IUnknown:QueryInterface (in: This=0xffa3c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x52ce63c | out: ppvObject=0x52ce63c*=0x0) returned 0x80004002 [0159.164] WbemLocator:IUnknown:QueryInterface (in: This=0xffa3c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52ce648 | out: ppvObject=0x52ce648*=0xffa31c) returned 0x0 [0159.164] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xffa31c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x52ce650 | out: pCid=0x52ce650*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0159.164] WbemLocator:IUnknown:Release (This=0xffa31c) returned 0x3 [0159.164] CoGetContextToken (in: pToken=0x52ce6a8 | out: pToken=0x52ce6a8) returned 0x0 [0159.164] CoGetContextToken (in: pToken=0x52ceab0 | out: pToken=0x52ceab0) returned 0x0 [0159.164] WbemLocator:IUnknown:QueryInterface (in: This=0xffa3c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x52ceb3c | out: ppvObject=0x52ceb3c*=0xffa3a4) returned 0x0 [0159.164] WbemLocator:IRpcOptions:Query (in: This=0xffa3a4, pPrx=0xffa3c0, dwProperty=2, pdwValue=0x52ceb48 | out: pdwValue=0x52ceb48) returned 0x80004002 [0159.164] WbemLocator:IUnknown:Release (This=0xffa3a4) returned 0x3 [0159.164] WbemLocator:IUnknown:Release (This=0xffa3c0) returned 0x2 [0159.164] CoGetContextToken (in: pToken=0x52cf090 | out: pToken=0x52cf090) returned 0x0 [0159.164] CoGetContextToken (in: pToken=0x52ceff0 | out: pToken=0x52ceff0) returned 0x0 [0159.164] WbemLocator:IUnknown:QueryInterface (in: This=0xffa3c0, riid=0x52cf0c0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x52cf0bc | out: ppvObject=0x52cf0bc*=0x103c288) returned 0x0 [0159.164] WbemLocator:IUnknown:AddRef (This=0x103c288) returned 0x4 [0159.165] WbemLocator:IUnknown:Release (This=0x103c288) returned 0x3 [0159.165] WbemLocator:IUnknown:Release (This=0x103c288) returned 0x2 [0159.165] SysStringLen (param_1=0x0) returned 0x0 [0159.165] CoUninitialize () Thread: id = 162 os_tid = 0x13a4 [0161.140] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0161.140] RoInitialize () returned 0x1 [0161.140] RoUninitialize () returned 0x0 [0161.141] CoGetClassObject (in: rclsid=0xfda16c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x540eb80 | out: ppv=0x540eb80*=0x1053900) returned 0x0 [0161.141] WbemLocator:IUnknown:QueryInterface (in: This=0x1053900, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x540ed9c | out: ppvObject=0x540ed9c*=0x0) returned 0x80004002 [0161.141] WbemLocator:IClassFactory:CreateInstance (in: This=0x1053900, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540eda8 | out: ppvObject=0x540eda8*=0x100fb18) returned 0x0 [0161.141] WbemLocator:IUnknown:Release (This=0x1053900) returned 0x0 [0161.142] WbemLocator:IUnknown:QueryInterface (in: This=0x100fb18, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e9cc | out: ppvObject=0x540e9cc*=0x100fb18) returned 0x0 [0161.142] WbemLocator:IUnknown:QueryInterface (in: This=0x100fb18, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x540e988 | out: ppvObject=0x540e988*=0x0) returned 0x80004002 [0161.142] WbemLocator:IUnknown:QueryInterface (in: This=0x100fb18, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x540e57c | out: ppvObject=0x540e57c*=0x0) returned 0x80004002 [0161.142] WbemLocator:IUnknown:AddRef (This=0x100fb18) returned 0x3 [0161.142] WbemLocator:IUnknown:QueryInterface (in: This=0x100fb18, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x540e2dc | out: ppvObject=0x540e2dc*=0x0) returned 0x80004002 [0161.142] WbemLocator:IUnknown:QueryInterface (in: This=0x100fb18, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x540e28c | out: ppvObject=0x540e28c*=0x0) returned 0x80004002 [0161.142] WbemLocator:IUnknown:QueryInterface (in: This=0x100fb18, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e298 | out: ppvObject=0x540e298*=0x0) returned 0x80004002 [0161.142] CoGetContextToken (in: pToken=0x540e2f8 | out: pToken=0x540e2f8) returned 0x0 [0161.142] CoGetContextToken (in: pToken=0x540e700 | out: pToken=0x540e700) returned 0x0 [0161.142] WbemLocator:IUnknown:QueryInterface (in: This=0x100fb18, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e78c | out: ppvObject=0x540e78c*=0x0) returned 0x80004002 [0161.143] WbemLocator:IUnknown:Release (This=0x100fb18) returned 0x2 [0161.143] WbemLocator:IUnknown:Release (This=0x100fb18) returned 0x1 [0161.143] CoGetContextToken (in: pToken=0x540ed88 | out: pToken=0x540ed88) returned 0x0 [0161.143] CoGetContextToken (in: pToken=0x540ece8 | out: pToken=0x540ece8) returned 0x0 [0161.143] WbemLocator:IUnknown:QueryInterface (in: This=0x100fb18, riid=0x540edb8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x540edb4 | out: ppvObject=0x540edb4*=0x100fb18) returned 0x0 [0161.143] WbemLocator:IUnknown:AddRef (This=0x100fb18) returned 0x3 [0161.143] WbemLocator:IUnknown:Release (This=0x100fb18) returned 0x2 [0161.143] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x540ef4c | out: puCount=0x540ef4c*=0x2) returned 0x0 [0161.143] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=8, puBuffLength=0x540ef48*=0x0, pszText=0x0 | out: puBuffLength=0x540ef48*=0xf, pszText=0x0) returned 0x0 [0161.143] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=8, puBuffLength=0x540ef48*=0xf, pszText="00000000000000" | out: puBuffLength=0x540ef48*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.143] CoCreateInstance (in: rclsid=0x6b3f13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6b3f1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x540ee24 | out: ppv=0x540ee24*=0x100fc08) returned 0x0 [0161.143] WbemLocator:IWbemLocator:ConnectServer (in: This=0x100fc08, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x540eeb8 | out: ppNamespace=0x540eeb8*=0x103b8d8) returned 0x0 [0161.174] WbemLocator:IUnknown:QueryInterface (in: This=0x103b8d8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540ed4c | out: ppvObject=0x540ed4c*=0xffab9c) returned 0x0 [0161.174] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xffab9c, pProxy=0x103b8d8, pAuthnSvc=0x540ed9c, pAuthzSvc=0x540ed98, pServerPrincName=0x540ed90, pAuthnLevel=0x540ed94, pImpLevel=0x540ed84, pAuthInfo=0x540ed88, pCapabilites=0x540ed8c | out: pAuthnSvc=0x540ed9c*=0xa, pAuthzSvc=0x540ed98*=0x0, pServerPrincName=0x540ed90, pAuthnLevel=0x540ed94*=0x6, pImpLevel=0x540ed84*=0x2, pAuthInfo=0x540ed88, pCapabilites=0x540ed8c*=0x1) returned 0x0 [0161.174] WbemLocator:IUnknown:Release (This=0xffab9c) returned 0x1 [0161.174] WbemLocator:IUnknown:QueryInterface (in: This=0x103b8d8, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540ed40 | out: ppvObject=0x540ed40*=0xffabc0) returned 0x0 [0161.175] WbemLocator:IUnknown:QueryInterface (in: This=0x103b8d8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540ed2c | out: ppvObject=0x540ed2c*=0xffab9c) returned 0x0 [0161.175] WbemLocator:IClientSecurity:SetBlanket (This=0xffab9c, pProxy=0x103b8d8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.175] WbemLocator:IUnknown:Release (This=0xffab9c) returned 0x2 [0161.175] WbemLocator:IUnknown:Release (This=0xffabc0) returned 0x1 [0161.175] CoTaskMemFree (pv=0x10571a8) [0161.175] WbemLocator:IUnknown:Release (This=0x100fc08) returned 0x0 [0161.175] WbemLocator:IUnknown:QueryInterface (in: This=0x103b8d8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e93c | out: ppvObject=0x540e93c*=0xffabc0) returned 0x0 [0161.175] WbemLocator:IUnknown:QueryInterface (in: This=0xffabc0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x540e8f8 | out: ppvObject=0x540e8f8*=0x0) returned 0x80004002 [0161.180] WbemLocator:IUnknown:QueryInterface (in: This=0xffabc0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x540e714 | out: ppvObject=0x540e714*=0x0) returned 0x80004002 [0161.185] WbemLocator:IUnknown:QueryInterface (in: This=0x103b8d8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x540e4ec | out: ppvObject=0x540e4ec*=0x0) returned 0x80004002 [0161.186] WbemLocator:IUnknown:AddRef (This=0xffabc0) returned 0x3 [0161.187] WbemLocator:IUnknown:QueryInterface (in: This=0xffabc0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x540e24c | out: ppvObject=0x540e24c*=0x0) returned 0x80004002 [0161.187] WbemLocator:IUnknown:QueryInterface (in: This=0xffabc0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x540e1fc | out: ppvObject=0x540e1fc*=0x0) returned 0x80004002 [0161.187] WbemLocator:IUnknown:QueryInterface (in: This=0xffabc0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e208 | out: ppvObject=0x540e208*=0xffab1c) returned 0x0 [0161.187] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xffab1c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x540e210 | out: pCid=0x540e210*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.187] WbemLocator:IUnknown:Release (This=0xffab1c) returned 0x3 [0161.187] CoGetContextToken (in: pToken=0x540e268 | out: pToken=0x540e268) returned 0x0 [0161.187] CoGetContextToken (in: pToken=0x540e670 | out: pToken=0x540e670) returned 0x0 [0161.187] WbemLocator:IUnknown:QueryInterface (in: This=0xffabc0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e6fc | out: ppvObject=0x540e6fc*=0xffaba4) returned 0x0 [0161.187] WbemLocator:IRpcOptions:Query (in: This=0xffaba4, pPrx=0xffabc0, dwProperty=2, pdwValue=0x540e708 | out: pdwValue=0x540e708) returned 0x80004002 [0161.187] WbemLocator:IUnknown:Release (This=0xffaba4) returned 0x3 [0161.187] WbemLocator:IUnknown:Release (This=0xffabc0) returned 0x2 [0161.187] CoGetContextToken (in: pToken=0x540ec50 | out: pToken=0x540ec50) returned 0x0 [0161.188] CoGetContextToken (in: pToken=0x540ebb0 | out: pToken=0x540ebb0) returned 0x0 [0161.188] WbemLocator:IUnknown:QueryInterface (in: This=0xffabc0, riid=0x540ec80*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x540ec7c | out: ppvObject=0x540ec7c*=0x103b8d8) returned 0x0 [0161.188] WbemLocator:IUnknown:AddRef (This=0x103b8d8) returned 0x4 [0161.188] WbemLocator:IUnknown:Release (This=0x103b8d8) returned 0x3 [0161.188] WbemLocator:IUnknown:Release (This=0x103b8d8) returned 0x2 [0161.188] SysStringLen (param_1=0x0) returned 0x0 [0161.188] CoUninitialize () Thread: id = 163 os_tid = 0x610 [0161.528] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0161.528] RoInitialize () returned 0x1 [0161.528] RoUninitialize () returned 0x0 [0161.529] CoGetClassObject (in: rclsid=0xfda16c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x540f110 | out: ppv=0x540f110*=0x1052d48) returned 0x0 [0161.529] WbemLocator:IUnknown:QueryInterface (in: This=0x1052d48, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x540f32c | out: ppvObject=0x540f32c*=0x0) returned 0x80004002 [0161.529] WbemLocator:IClassFactory:CreateInstance (in: This=0x1052d48, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540f338 | out: ppvObject=0x540f338*=0x100fab8) returned 0x0 [0161.529] WbemLocator:IUnknown:Release (This=0x1052d48) returned 0x0 [0161.529] WbemLocator:IUnknown:QueryInterface (in: This=0x100fab8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540ef5c | out: ppvObject=0x540ef5c*=0x100fab8) returned 0x0 [0161.530] WbemLocator:IUnknown:QueryInterface (in: This=0x100fab8, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x540ef18 | out: ppvObject=0x540ef18*=0x0) returned 0x80004002 [0161.530] WbemLocator:IUnknown:QueryInterface (in: This=0x100fab8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x540eb0c | out: ppvObject=0x540eb0c*=0x0) returned 0x80004002 [0161.530] WbemLocator:IUnknown:AddRef (This=0x100fab8) returned 0x3 [0161.530] WbemLocator:IUnknown:QueryInterface (in: This=0x100fab8, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x540e86c | out: ppvObject=0x540e86c*=0x0) returned 0x80004002 [0161.530] WbemLocator:IUnknown:QueryInterface (in: This=0x100fab8, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x540e81c | out: ppvObject=0x540e81c*=0x0) returned 0x80004002 [0161.530] WbemLocator:IUnknown:QueryInterface (in: This=0x100fab8, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e828 | out: ppvObject=0x540e828*=0x0) returned 0x80004002 [0161.530] CoGetContextToken (in: pToken=0x540e888 | out: pToken=0x540e888) returned 0x0 [0161.530] CoGetContextToken (in: pToken=0x540ec90 | out: pToken=0x540ec90) returned 0x0 [0161.530] WbemLocator:IUnknown:QueryInterface (in: This=0x100fab8, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540ed1c | out: ppvObject=0x540ed1c*=0x0) returned 0x80004002 [0161.531] WbemLocator:IUnknown:Release (This=0x100fab8) returned 0x2 [0161.531] WbemLocator:IUnknown:Release (This=0x100fab8) returned 0x1 [0161.531] CoGetContextToken (in: pToken=0x540f318 | out: pToken=0x540f318) returned 0x0 [0161.531] CoGetContextToken (in: pToken=0x540f278 | out: pToken=0x540f278) returned 0x0 [0161.531] WbemLocator:IUnknown:QueryInterface (in: This=0x100fab8, riid=0x540f348*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x540f344 | out: ppvObject=0x540f344*=0x100fab8) returned 0x0 [0161.531] WbemLocator:IUnknown:AddRef (This=0x100fab8) returned 0x3 [0161.531] WbemLocator:IUnknown:Release (This=0x100fab8) returned 0x2 [0161.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x540f4dc | out: puCount=0x540f4dc*=0x2) returned 0x0 [0161.531] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=8, puBuffLength=0x540f4d8*=0x0, pszText=0x0 | out: puBuffLength=0x540f4d8*=0xf, pszText=0x0) returned 0x0 [0161.531] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=8, puBuffLength=0x540f4d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x540f4d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0161.531] CoCreateInstance (in: rclsid=0x6b3f13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6b3f1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x540f3b4 | out: ppv=0x540f3b4*=0x100fc98) returned 0x0 [0161.531] WbemLocator:IWbemLocator:ConnectServer (in: This=0x100fc98, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x540f448 | out: ppNamespace=0x540f448*=0x103be28) returned 0x0 [0161.553] WbemLocator:IUnknown:QueryInterface (in: This=0x103be28, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540f2dc | out: ppvObject=0x540f2dc*=0xff8e9c) returned 0x0 [0161.554] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff8e9c, pProxy=0x103be28, pAuthnSvc=0x540f32c, pAuthzSvc=0x540f328, pServerPrincName=0x540f320, pAuthnLevel=0x540f324, pImpLevel=0x540f314, pAuthInfo=0x540f318, pCapabilites=0x540f31c | out: pAuthnSvc=0x540f32c*=0xa, pAuthzSvc=0x540f328*=0x0, pServerPrincName=0x540f320, pAuthnLevel=0x540f324*=0x6, pImpLevel=0x540f314*=0x2, pAuthInfo=0x540f318, pCapabilites=0x540f31c*=0x1) returned 0x0 [0161.554] WbemLocator:IUnknown:Release (This=0xff8e9c) returned 0x1 [0161.554] WbemLocator:IUnknown:QueryInterface (in: This=0x103be28, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540f2d0 | out: ppvObject=0x540f2d0*=0xff8ec0) returned 0x0 [0161.554] WbemLocator:IUnknown:QueryInterface (in: This=0x103be28, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540f2bc | out: ppvObject=0x540f2bc*=0xff8e9c) returned 0x0 [0161.554] WbemLocator:IClientSecurity:SetBlanket (This=0xff8e9c, pProxy=0x103be28, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0161.554] WbemLocator:IUnknown:Release (This=0xff8e9c) returned 0x2 [0161.554] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x1 [0161.554] CoTaskMemFree (pv=0x1057598) [0161.554] WbemLocator:IUnknown:Release (This=0x100fc98) returned 0x0 [0161.555] WbemLocator:IUnknown:QueryInterface (in: This=0x103be28, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540eecc | out: ppvObject=0x540eecc*=0xff8ec0) returned 0x0 [0161.555] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x540ee88 | out: ppvObject=0x540ee88*=0x0) returned 0x80004002 [0161.555] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x540eca4 | out: ppvObject=0x540eca4*=0x0) returned 0x80004002 [0161.556] WbemLocator:IUnknown:QueryInterface (in: This=0x103be28, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x540ea7c | out: ppvObject=0x540ea7c*=0x0) returned 0x80004002 [0161.556] WbemLocator:IUnknown:AddRef (This=0xff8ec0) returned 0x3 [0161.556] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x540e7dc | out: ppvObject=0x540e7dc*=0x0) returned 0x80004002 [0161.556] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x540e78c | out: ppvObject=0x540e78c*=0x0) returned 0x80004002 [0161.556] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e798 | out: ppvObject=0x540e798*=0xff8e1c) returned 0x0 [0161.557] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff8e1c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x540e7a0 | out: pCid=0x540e7a0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0161.557] WbemLocator:IUnknown:Release (This=0xff8e1c) returned 0x3 [0161.557] CoGetContextToken (in: pToken=0x540e7f8 | out: pToken=0x540e7f8) returned 0x0 [0161.557] CoGetContextToken (in: pToken=0x540ec00 | out: pToken=0x540ec00) returned 0x0 [0161.557] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540ec8c | out: ppvObject=0x540ec8c*=0xff8ea4) returned 0x0 [0161.557] WbemLocator:IRpcOptions:Query (in: This=0xff8ea4, pPrx=0xff8ec0, dwProperty=2, pdwValue=0x540ec98 | out: pdwValue=0x540ec98) returned 0x80004002 [0161.557] WbemLocator:IUnknown:Release (This=0xff8ea4) returned 0x3 [0161.557] WbemLocator:IUnknown:Release (This=0xff8ec0) returned 0x2 [0161.557] CoGetContextToken (in: pToken=0x540f1e0 | out: pToken=0x540f1e0) returned 0x0 [0161.557] CoGetContextToken (in: pToken=0x540f140 | out: pToken=0x540f140) returned 0x0 [0161.557] WbemLocator:IUnknown:QueryInterface (in: This=0xff8ec0, riid=0x540f210*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x540f20c | out: ppvObject=0x540f20c*=0x103be28) returned 0x0 [0161.557] WbemLocator:IUnknown:AddRef (This=0x103be28) returned 0x4 [0161.557] WbemLocator:IUnknown:Release (This=0x103be28) returned 0x3 [0161.557] WbemLocator:IUnknown:Release (This=0x103be28) returned 0x2 [0161.557] SysStringLen (param_1=0x0) returned 0x0 [0161.558] CoUninitialize () Thread: id = 164 os_tid = 0x131c [0162.941] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0162.941] RoInitialize () returned 0x1 [0162.941] RoUninitialize () returned 0x0 [0162.942] CoGetClassObject (in: rclsid=0xfda16c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x540e9b0 | out: ppv=0x540e9b0*=0x1052bf8) returned 0x0 [0162.942] WbemLocator:IUnknown:QueryInterface (in: This=0x1052bf8, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x540ebcc | out: ppvObject=0x540ebcc*=0x0) returned 0x80004002 [0162.942] WbemLocator:IClassFactory:CreateInstance (in: This=0x1052bf8, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540ebd8 | out: ppvObject=0x540ebd8*=0x100fac8) returned 0x0 [0162.942] WbemLocator:IUnknown:Release (This=0x1052bf8) returned 0x0 [0162.942] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e7fc | out: ppvObject=0x540e7fc*=0x100fac8) returned 0x0 [0162.942] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x540e7b8 | out: ppvObject=0x540e7b8*=0x0) returned 0x80004002 [0162.942] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x540e3ac | out: ppvObject=0x540e3ac*=0x0) returned 0x80004002 [0162.943] WbemLocator:IUnknown:AddRef (This=0x100fac8) returned 0x3 [0162.943] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x540e10c | out: ppvObject=0x540e10c*=0x0) returned 0x80004002 [0162.943] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x540e0bc | out: ppvObject=0x540e0bc*=0x0) returned 0x80004002 [0162.943] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e0c8 | out: ppvObject=0x540e0c8*=0x0) returned 0x80004002 [0162.943] CoGetContextToken (in: pToken=0x540e128 | out: pToken=0x540e128) returned 0x0 [0162.944] CoGetContextToken (in: pToken=0x540e530 | out: pToken=0x540e530) returned 0x0 [0162.944] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e5bc | out: ppvObject=0x540e5bc*=0x0) returned 0x80004002 [0162.944] WbemLocator:IUnknown:Release (This=0x100fac8) returned 0x2 [0162.944] WbemLocator:IUnknown:Release (This=0x100fac8) returned 0x1 [0162.944] CoGetContextToken (in: pToken=0x540ebb8 | out: pToken=0x540ebb8) returned 0x0 [0162.944] CoGetContextToken (in: pToken=0x540eb18 | out: pToken=0x540eb18) returned 0x0 [0162.944] WbemLocator:IUnknown:QueryInterface (in: This=0x100fac8, riid=0x540ebe8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x540ebe4 | out: ppvObject=0x540ebe4*=0x100fac8) returned 0x0 [0162.945] WbemLocator:IUnknown:AddRef (This=0x100fac8) returned 0x3 [0162.945] WbemLocator:IUnknown:Release (This=0x100fac8) returned 0x2 [0162.945] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x540ed7c | out: puCount=0x540ed7c*=0x2) returned 0x0 [0162.945] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=8, puBuffLength=0x540ed78*=0x0, pszText=0x0 | out: puBuffLength=0x540ed78*=0xf, pszText=0x0) returned 0x0 [0162.945] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=8, puBuffLength=0x540ed78*=0xf, pszText="00000000000000" | out: puBuffLength=0x540ed78*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0162.945] CoCreateInstance (in: rclsid=0x6b3f13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6b3f1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x540ec54 | out: ppv=0x540ec54*=0x100fae8) returned 0x0 [0162.945] WbemLocator:IWbemLocator:ConnectServer (in: This=0x100fae8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x540ece8 | out: ppNamespace=0x540ece8*=0x103b4c8) returned 0x0 [0162.967] WbemLocator:IUnknown:QueryInterface (in: This=0x103b4c8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540eb7c | out: ppvObject=0x540eb7c*=0xff919c) returned 0x0 [0162.967] WbemLocator:IClientSecurity:QueryBlanket (in: This=0xff919c, pProxy=0x103b4c8, pAuthnSvc=0x540ebcc, pAuthzSvc=0x540ebc8, pServerPrincName=0x540ebc0, pAuthnLevel=0x540ebc4, pImpLevel=0x540ebb4, pAuthInfo=0x540ebb8, pCapabilites=0x540ebbc | out: pAuthnSvc=0x540ebcc*=0xa, pAuthzSvc=0x540ebc8*=0x0, pServerPrincName=0x540ebc0, pAuthnLevel=0x540ebc4*=0x6, pImpLevel=0x540ebb4*=0x2, pAuthInfo=0x540ebb8, pCapabilites=0x540ebbc*=0x1) returned 0x0 [0162.967] WbemLocator:IUnknown:Release (This=0xff919c) returned 0x1 [0162.967] WbemLocator:IUnknown:QueryInterface (in: This=0x103b4c8, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540eb70 | out: ppvObject=0x540eb70*=0xff91c0) returned 0x0 [0162.967] WbemLocator:IUnknown:QueryInterface (in: This=0x103b4c8, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540eb5c | out: ppvObject=0x540eb5c*=0xff919c) returned 0x0 [0162.967] WbemLocator:IClientSecurity:SetBlanket (This=0xff919c, pProxy=0x103b4c8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0162.967] WbemLocator:IUnknown:Release (This=0xff919c) returned 0x2 [0162.967] WbemLocator:IUnknown:Release (This=0xff91c0) returned 0x1 [0162.967] CoTaskMemFree (pv=0x1057598) [0162.968] WbemLocator:IUnknown:Release (This=0x100fae8) returned 0x0 [0162.968] WbemLocator:IUnknown:QueryInterface (in: This=0x103b4c8, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e76c | out: ppvObject=0x540e76c*=0xff91c0) returned 0x0 [0162.968] WbemLocator:IUnknown:QueryInterface (in: This=0xff91c0, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x540e728 | out: ppvObject=0x540e728*=0x0) returned 0x80004002 [0162.968] WbemLocator:IUnknown:QueryInterface (in: This=0xff91c0, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x540e544 | out: ppvObject=0x540e544*=0x0) returned 0x80004002 [0162.969] WbemLocator:IUnknown:QueryInterface (in: This=0x103b4c8, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x540e31c | out: ppvObject=0x540e31c*=0x0) returned 0x80004002 [0162.969] WbemLocator:IUnknown:AddRef (This=0xff91c0) returned 0x3 [0162.969] WbemLocator:IUnknown:QueryInterface (in: This=0xff91c0, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x540e07c | out: ppvObject=0x540e07c*=0x0) returned 0x80004002 [0162.969] WbemLocator:IUnknown:QueryInterface (in: This=0xff91c0, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x540e02c | out: ppvObject=0x540e02c*=0x0) returned 0x80004002 [0162.969] WbemLocator:IUnknown:QueryInterface (in: This=0xff91c0, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e038 | out: ppvObject=0x540e038*=0xff911c) returned 0x0 [0162.970] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0xff911c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x540e040 | out: pCid=0x540e040*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0162.970] WbemLocator:IUnknown:Release (This=0xff911c) returned 0x3 [0162.970] CoGetContextToken (in: pToken=0x540e098 | out: pToken=0x540e098) returned 0x0 [0162.970] CoGetContextToken (in: pToken=0x540e4a0 | out: pToken=0x540e4a0) returned 0x0 [0162.970] WbemLocator:IUnknown:QueryInterface (in: This=0xff91c0, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e52c | out: ppvObject=0x540e52c*=0xff91a4) returned 0x0 [0162.970] WbemLocator:IRpcOptions:Query (in: This=0xff91a4, pPrx=0xff91c0, dwProperty=2, pdwValue=0x540e538 | out: pdwValue=0x540e538) returned 0x80004002 [0162.970] WbemLocator:IUnknown:Release (This=0xff91a4) returned 0x3 [0162.970] WbemLocator:IUnknown:Release (This=0xff91c0) returned 0x2 [0162.970] CoGetContextToken (in: pToken=0x540ea80 | out: pToken=0x540ea80) returned 0x0 [0162.970] CoGetContextToken (in: pToken=0x540e9e0 | out: pToken=0x540e9e0) returned 0x0 [0162.970] WbemLocator:IUnknown:QueryInterface (in: This=0xff91c0, riid=0x540eab0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x540eaac | out: ppvObject=0x540eaac*=0x103b4c8) returned 0x0 [0162.970] WbemLocator:IUnknown:AddRef (This=0x103b4c8) returned 0x4 [0162.970] WbemLocator:IUnknown:Release (This=0x103b4c8) returned 0x3 [0162.970] WbemLocator:IUnknown:Release (This=0x103b4c8) returned 0x2 [0162.970] SysStringLen (param_1=0x0) returned 0x0 [0162.970] CoUninitialize () Thread: id = 165 os_tid = 0x784 [0163.116] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0163.116] RoInitialize () returned 0x1 [0163.116] RoUninitialize () returned 0x0 [0163.118] CoGetClassObject (in: rclsid=0xfda16c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f2a4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x540eae0 | out: ppv=0x540eae0*=0x102e0d0) returned 0x0 [0163.118] WbemLocator:IUnknown:QueryInterface (in: This=0x102e0d0, riid=0x6f2879fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x540ecfc | out: ppvObject=0x540ecfc*=0x0) returned 0x80004002 [0163.118] WbemLocator:IClassFactory:CreateInstance (in: This=0x102e0d0, pUnkOuter=0x0, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540ed08 | out: ppvObject=0x540ed08*=0xfdc330) returned 0x0 [0163.118] WbemLocator:IUnknown:Release (This=0x102e0d0) returned 0x0 [0163.118] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc330, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e92c | out: ppvObject=0x540e92c*=0xfdc330) returned 0x0 [0163.118] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc330, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x540e8e8 | out: ppvObject=0x540e8e8*=0x0) returned 0x80004002 [0163.118] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc330, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x540e4dc | out: ppvObject=0x540e4dc*=0x0) returned 0x80004002 [0163.118] WbemLocator:IUnknown:AddRef (This=0xfdc330) returned 0x3 [0163.118] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc330, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x540e23c | out: ppvObject=0x540e23c*=0x0) returned 0x80004002 [0163.118] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc330, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x540e1ec | out: ppvObject=0x540e1ec*=0x0) returned 0x80004002 [0163.119] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc330, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e1f8 | out: ppvObject=0x540e1f8*=0x0) returned 0x80004002 [0163.119] CoGetContextToken (in: pToken=0x540e258 | out: pToken=0x540e258) returned 0x0 [0163.119] CoGetContextToken (in: pToken=0x540e660 | out: pToken=0x540e660) returned 0x0 [0163.119] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc330, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e6ec | out: ppvObject=0x540e6ec*=0x0) returned 0x80004002 [0163.119] WbemLocator:IUnknown:Release (This=0xfdc330) returned 0x2 [0163.119] WbemLocator:IUnknown:Release (This=0xfdc330) returned 0x1 [0163.119] CoGetContextToken (in: pToken=0x540ece8 | out: pToken=0x540ece8) returned 0x0 [0163.119] CoGetContextToken (in: pToken=0x540ec48 | out: pToken=0x540ec48) returned 0x0 [0163.119] WbemLocator:IUnknown:QueryInterface (in: This=0xfdc330, riid=0x540ed18*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x540ed14 | out: ppvObject=0x540ed14*=0xfdc330) returned 0x0 [0163.119] WbemLocator:IUnknown:AddRef (This=0xfdc330) returned 0x3 [0163.119] WbemLocator:IUnknown:Release (This=0xfdc330) returned 0x2 [0163.119] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0xfc1f50, puCount=0x540eeac | out: puCount=0x540eeac*=0x2) returned 0x0 [0163.119] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=8, puBuffLength=0x540eea8*=0x0, pszText=0x0 | out: puBuffLength=0x540eea8*=0xf, pszText=0x0) returned 0x0 [0163.119] WbemDefPath:IWbemPath:GetText (in: This=0xfc1f50, lFlags=8, puBuffLength=0x540eea8*=0xf, pszText="00000000000000" | out: puBuffLength=0x540eea8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0163.120] CoCreateInstance (in: rclsid=0x6b3f13b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6b3f1414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x540ed84 | out: ppv=0x540ed84*=0xfdc360) returned 0x0 [0163.120] WbemLocator:IWbemLocator:ConnectServer (in: This=0xfdc360, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x540ee18 | out: ppNamespace=0x540ee18*=0x103b518) returned 0x0 [0163.143] WbemLocator:IUnknown:QueryInterface (in: This=0x103b518, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540ecac | out: ppvObject=0x540ecac*=0x101af0c) returned 0x0 [0163.143] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x101af0c, pProxy=0x103b518, pAuthnSvc=0x540ecfc, pAuthzSvc=0x540ecf8, pServerPrincName=0x540ecf0, pAuthnLevel=0x540ecf4, pImpLevel=0x540ece4, pAuthInfo=0x540ece8, pCapabilites=0x540ecec | out: pAuthnSvc=0x540ecfc*=0xa, pAuthzSvc=0x540ecf8*=0x0, pServerPrincName=0x540ecf0, pAuthnLevel=0x540ecf4*=0x6, pImpLevel=0x540ece4*=0x2, pAuthInfo=0x540ece8, pCapabilites=0x540ecec*=0x1) returned 0x0 [0163.143] WbemLocator:IUnknown:Release (This=0x101af0c) returned 0x1 [0163.143] WbemLocator:IUnknown:QueryInterface (in: This=0x103b518, riid=0x6b3f1224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540eca0 | out: ppvObject=0x540eca0*=0x101af30) returned 0x0 [0163.144] WbemLocator:IUnknown:QueryInterface (in: This=0x103b518, riid=0x6b3f1234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540ec8c | out: ppvObject=0x540ec8c*=0x101af0c) returned 0x0 [0163.144] WbemLocator:IClientSecurity:SetBlanket (This=0x101af0c, pProxy=0x103b518, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0163.144] WbemLocator:IUnknown:Release (This=0x101af0c) returned 0x2 [0163.144] WbemLocator:IUnknown:Release (This=0x101af30) returned 0x1 [0163.144] CoTaskMemFree (pv=0x10570b8) [0163.144] WbemLocator:IUnknown:Release (This=0xfdc360) returned 0x0 [0163.144] WbemLocator:IUnknown:QueryInterface (in: This=0x103b518, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e89c | out: ppvObject=0x540e89c*=0x101af30) returned 0x0 [0163.145] WbemLocator:IUnknown:QueryInterface (in: This=0x101af30, riid=0x6f2c9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x540e858 | out: ppvObject=0x540e858*=0x0) returned 0x80004002 [0163.146] WbemLocator:IUnknown:QueryInterface (in: This=0x101af30, riid=0x6f2c9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x540e674 | out: ppvObject=0x540e674*=0x0) returned 0x80004002 [0163.146] WbemLocator:IUnknown:QueryInterface (in: This=0x103b518, riid=0x6f2c9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x540e44c | out: ppvObject=0x540e44c*=0x0) returned 0x80004002 [0163.147] WbemLocator:IUnknown:AddRef (This=0x101af30) returned 0x3 [0163.147] WbemLocator:IUnknown:QueryInterface (in: This=0x101af30, riid=0x6f2c98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x540e1ac | out: ppvObject=0x540e1ac*=0x0) returned 0x80004002 [0163.147] WbemLocator:IUnknown:QueryInterface (in: This=0x101af30, riid=0x6f2c9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x540e15c | out: ppvObject=0x540e15c*=0x0) returned 0x80004002 [0163.147] WbemLocator:IUnknown:QueryInterface (in: This=0x101af30, riid=0x6f16a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e168 | out: ppvObject=0x540e168*=0x101ae8c) returned 0x0 [0163.147] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x101ae8c, riid=0x6f15de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x540e170 | out: pCid=0x540e170*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0163.147] WbemLocator:IUnknown:Release (This=0x101ae8c) returned 0x3 [0163.147] CoGetContextToken (in: pToken=0x540e1c8 | out: pToken=0x540e1c8) returned 0x0 [0163.147] CoGetContextToken (in: pToken=0x540e5d0 | out: pToken=0x540e5d0) returned 0x0 [0163.147] WbemLocator:IUnknown:QueryInterface (in: This=0x101af30, riid=0x6f2c9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x540e65c | out: ppvObject=0x540e65c*=0x101af14) returned 0x0 [0163.147] WbemLocator:IRpcOptions:Query (in: This=0x101af14, pPrx=0x101af30, dwProperty=2, pdwValue=0x540e668 | out: pdwValue=0x540e668) returned 0x80004002 [0163.147] WbemLocator:IUnknown:Release (This=0x101af14) returned 0x3 [0163.147] WbemLocator:IUnknown:Release (This=0x101af30) returned 0x2 [0163.147] CoGetContextToken (in: pToken=0x540ebb0 | out: pToken=0x540ebb0) returned 0x0 [0163.148] CoGetContextToken (in: pToken=0x540eb10 | out: pToken=0x540eb10) returned 0x0 [0163.148] WbemLocator:IUnknown:QueryInterface (in: This=0x101af30, riid=0x540ebe0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x540ebdc | out: ppvObject=0x540ebdc*=0x103b518) returned 0x0 [0163.148] WbemLocator:IUnknown:AddRef (This=0x103b518) returned 0x4 [0163.148] WbemLocator:IUnknown:Release (This=0x103b518) returned 0x3 [0163.148] WbemLocator:IUnknown:Release (This=0x103b518) returned 0x2 [0163.148] SysStringLen (param_1=0x0) returned 0x0 [0163.148] CoUninitialize () Thread: id = 166 os_tid = 0x27c Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x747fa000" os_pid = "0x3f4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cca2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 575 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 576 start_va = 0xf902400000 end_va = 0xf9025fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902400000" filename = "" Region: id = 577 start_va = 0xf902600000 end_va = 0xf90267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902600000" filename = "" Region: id = 578 start_va = 0xf902800000 end_va = 0xf9028fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902800000" filename = "" Region: id = 579 start_va = 0xf902900000 end_va = 0xf9029fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902900000" filename = "" Region: id = 580 start_va = 0xf902a00000 end_va = 0xf902afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902a00000" filename = "" Region: id = 581 start_va = 0xf902b00000 end_va = 0xf902bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902b00000" filename = "" Region: id = 582 start_va = 0xf902c00000 end_va = 0xf902cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902c00000" filename = "" Region: id = 583 start_va = 0xf902e00000 end_va = 0xf902efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f902e00000" filename = "" Region: id = 584 start_va = 0xf903000000 end_va = 0xf90307ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903000000" filename = "" Region: id = 585 start_va = 0xf903080000 end_va = 0xf90317ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903080000" filename = "" Region: id = 586 start_va = 0xf903180000 end_va = 0xf90327ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903180000" filename = "" Region: id = 587 start_va = 0xf903280000 end_va = 0xf90337ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903280000" filename = "" Region: id = 588 start_va = 0xf903480000 end_va = 0xf90357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903480000" filename = "" Region: id = 589 start_va = 0xf903700000 end_va = 0xf9037fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903700000" filename = "" Region: id = 590 start_va = 0xf903800000 end_va = 0xf9038fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903800000" filename = "" Region: id = 591 start_va = 0xf903980000 end_va = 0xf903a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903980000" filename = "" Region: id = 592 start_va = 0xf903a80000 end_va = 0xf903b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903a80000" filename = "" Region: id = 593 start_va = 0xf903b80000 end_va = 0xf903c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903b80000" filename = "" Region: id = 594 start_va = 0xf903f80000 end_va = 0xf90407ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f903f80000" filename = "" Region: id = 595 start_va = 0xf904080000 end_va = 0xf90417ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904080000" filename = "" Region: id = 596 start_va = 0xf904180000 end_va = 0xf9041fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904180000" filename = "" Region: id = 597 start_va = 0xf904200000 end_va = 0xf9042fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904200000" filename = "" Region: id = 598 start_va = 0xf904300000 end_va = 0xf9043fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904300000" filename = "" Region: id = 599 start_va = 0xf904600000 end_va = 0xf9046fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904600000" filename = "" Region: id = 600 start_va = 0xf904900000 end_va = 0xf90497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904900000" filename = "" Region: id = 601 start_va = 0xf904a00000 end_va = 0xf904a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904a00000" filename = "" Region: id = 602 start_va = 0xf904b00000 end_va = 0xf904b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904b00000" filename = "" Region: id = 603 start_va = 0xf904c00000 end_va = 0xf904c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904c00000" filename = "" Region: id = 604 start_va = 0xf904c80000 end_va = 0xf904d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904c80000" filename = "" Region: id = 605 start_va = 0xf904d80000 end_va = 0xf904e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904d80000" filename = "" Region: id = 606 start_va = 0xf904f80000 end_va = 0xf90507ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f904f80000" filename = "" Region: id = 607 start_va = 0xf905080000 end_va = 0xf90517ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f905080000" filename = "" Region: id = 608 start_va = 0xf905180000 end_va = 0xf90527ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f905180000" filename = "" Region: id = 609 start_va = 0xf905300000 end_va = 0xf9053fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f905300000" filename = "" Region: id = 610 start_va = 0xf905480000 end_va = 0xf90557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f905480000" filename = "" Region: id = 611 start_va = 0xf905680000 end_va = 0xf90577ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f905680000" filename = "" Region: id = 612 start_va = 0xf905f00000 end_va = 0xf905ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f905f00000" filename = "" Region: id = 613 start_va = 0xf906000000 end_va = 0xf9060fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906000000" filename = "" Region: id = 614 start_va = 0xf906100000 end_va = 0xf9061fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906100000" filename = "" Region: id = 615 start_va = 0xf906200000 end_va = 0xf9062fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906200000" filename = "" Region: id = 616 start_va = 0xf906300000 end_va = 0xf9063fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906300000" filename = "" Region: id = 617 start_va = 0xf906600000 end_va = 0xf9066fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906600000" filename = "" Region: id = 618 start_va = 0xf906e00000 end_va = 0xf906efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906e00000" filename = "" Region: id = 619 start_va = 0xf906f00000 end_va = 0xf906ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f906f00000" filename = "" Region: id = 620 start_va = 0xf907000000 end_va = 0xf9070fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907000000" filename = "" Region: id = 621 start_va = 0xf907100000 end_va = 0xf9071fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907100000" filename = "" Region: id = 622 start_va = 0xf907200000 end_va = 0xf90727ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907200000" filename = "" Region: id = 623 start_va = 0xf907280000 end_va = 0xf90737ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907280000" filename = "" Region: id = 624 start_va = 0xf907380000 end_va = 0xf90747ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907380000" filename = "" Region: id = 625 start_va = 0xf907480000 end_va = 0xf90757ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907480000" filename = "" Region: id = 626 start_va = 0xf907580000 end_va = 0xf9075fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907580000" filename = "" Region: id = 627 start_va = 0xf907600000 end_va = 0xf90767ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907600000" filename = "" Region: id = 628 start_va = 0xf907700000 end_va = 0xf9077fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907700000" filename = "" Region: id = 629 start_va = 0xf907800000 end_va = 0xf9078fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907800000" filename = "" Region: id = 630 start_va = 0xf907900000 end_va = 0xf9079fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907900000" filename = "" Region: id = 631 start_va = 0xf907a00000 end_va = 0xf907afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907a00000" filename = "" Region: id = 632 start_va = 0xf907b00000 end_va = 0xf907bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907b00000" filename = "" Region: id = 633 start_va = 0xf907c00000 end_va = 0xf907cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907c00000" filename = "" Region: id = 634 start_va = 0xf907d00000 end_va = 0xf907dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907d00000" filename = "" Region: id = 635 start_va = 0xf907e00000 end_va = 0xf907efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907e00000" filename = "" Region: id = 636 start_va = 0xf907f00000 end_va = 0xf907ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f907f00000" filename = "" Region: id = 637 start_va = 0xf908000000 end_va = 0xf9080fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908000000" filename = "" Region: id = 638 start_va = 0xf908100000 end_va = 0xf9081fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908100000" filename = "" Region: id = 639 start_va = 0xf908200000 end_va = 0xf9082fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908200000" filename = "" Region: id = 640 start_va = 0xf908300000 end_va = 0xf9083fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908300000" filename = "" Region: id = 641 start_va = 0xf908400000 end_va = 0xf9084fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908400000" filename = "" Region: id = 642 start_va = 0xf908500000 end_va = 0xf9085fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908500000" filename = "" Region: id = 643 start_va = 0xf908600000 end_va = 0xf9086fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908600000" filename = "" Region: id = 644 start_va = 0xf908700000 end_va = 0xf9087fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908700000" filename = "" Region: id = 645 start_va = 0xf908800000 end_va = 0xf9088fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908800000" filename = "" Region: id = 646 start_va = 0xf908900000 end_va = 0xf9089fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908900000" filename = "" Region: id = 647 start_va = 0xf908a00000 end_va = 0xf908afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908a00000" filename = "" Region: id = 648 start_va = 0xf908b00000 end_va = 0xf908bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908b00000" filename = "" Region: id = 649 start_va = 0xf908c00000 end_va = 0xf908cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908c00000" filename = "" Region: id = 650 start_va = 0xf908d00000 end_va = 0xf908dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908d00000" filename = "" Region: id = 651 start_va = 0xf908e00000 end_va = 0xf908efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908e00000" filename = "" Region: id = 652 start_va = 0xf908f00000 end_va = 0xf908ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f908f00000" filename = "" Region: id = 653 start_va = 0xf909000000 end_va = 0xf9090fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f909000000" filename = "" Region: id = 654 start_va = 0xf909100000 end_va = 0xf9091fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f909100000" filename = "" Region: id = 655 start_va = 0xf909200000 end_va = 0xf9092fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f909200000" filename = "" Region: id = 656 start_va = 0xf909300000 end_va = 0xf90937ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f909300000" filename = "" Region: id = 657 start_va = 0xf909380000 end_va = 0xf9093fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f909380000" filename = "" Region: id = 658 start_va = 0xf909600000 end_va = 0xf9096fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f909600000" filename = "" Region: id = 659 start_va = 0xf909900000 end_va = 0xf90997ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f909900000" filename = "" Region: id = 660 start_va = 0xf909b80000 end_va = 0xf909bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f909b80000" filename = "" Region: id = 661 start_va = 0xf909c00000 end_va = 0xf909cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f909c00000" filename = "" Region: id = 662 start_va = 0xf909d00000 end_va = 0xf909dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f909d00000" filename = "" Region: id = 663 start_va = 0xf90a000000 end_va = 0xf90a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90a000000" filename = "" Region: id = 664 start_va = 0xf90ac80000 end_va = 0xf90ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90ac80000" filename = "" Region: id = 665 start_va = 0xf90af80000 end_va = 0xf90affffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90af80000" filename = "" Region: id = 666 start_va = 0xf90b000000 end_va = 0xf90b0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90b000000" filename = "" Region: id = 667 start_va = 0xf90b100000 end_va = 0xf90b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90b100000" filename = "" Region: id = 668 start_va = 0x20332ec0000 end_va = 0x20332ecffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332ec0000" filename = "" Region: id = 669 start_va = 0x20332ed0000 end_va = 0x20332ed0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 670 start_va = 0x20332ee0000 end_va = 0x20332ef4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332ee0000" filename = "" Region: id = 671 start_va = 0x20332f00000 end_va = 0x20332f03fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332f00000" filename = "" Region: id = 672 start_va = 0x20332f10000 end_va = 0x20332f10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332f10000" filename = "" Region: id = 673 start_va = 0x20332f20000 end_va = 0x20332f21fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020332f20000" filename = "" Region: id = 674 start_va = 0x20332f30000 end_va = 0x20332f30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020332f30000" filename = "" Region: id = 675 start_va = 0x20332f40000 end_va = 0x20332f40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020332f40000" filename = "" Region: id = 676 start_va = 0x20332f50000 end_va = 0x20332f50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332f50000" filename = "" Region: id = 677 start_va = 0x20332f60000 end_va = 0x20332f60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332f60000" filename = "" Region: id = 678 start_va = 0x20332f70000 end_va = 0x20332f70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332f70000" filename = "" Region: id = 679 start_va = 0x20332f80000 end_va = 0x20332f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020332f80000" filename = "" Region: id = 680 start_va = 0x20332f90000 end_va = 0x20332f90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332f90000" filename = "" Region: id = 681 start_va = 0x20332fa0000 end_va = 0x20332fa8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 682 start_va = 0x20332fb0000 end_va = 0x20332fbcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 683 start_va = 0x20332fc0000 end_va = 0x20332fc1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332fc0000" filename = "" Region: id = 684 start_va = 0x20332fd0000 end_va = 0x20332fd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020332fd0000" filename = "" Region: id = 685 start_va = 0x20332fe0000 end_va = 0x20332fe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020332fe0000" filename = "" Region: id = 686 start_va = 0x20332ff0000 end_va = 0x20332ff3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 687 start_va = 0x20333000000 end_va = 0x203330fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020333000000" filename = "" Region: id = 688 start_va = 0x20333100000 end_va = 0x203331bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 689 start_va = 0x203331c0000 end_va = 0x2033327ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000203331c0000" filename = "" Region: id = 690 start_va = 0x20333280000 end_va = 0x203332c4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000010.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db") Region: id = 691 start_va = 0x203332d0000 end_va = 0x203332d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 692 start_va = 0x203332e0000 end_va = 0x203332ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 693 start_va = 0x203332f0000 end_va = 0x203332f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000203332f0000" filename = "" Region: id = 694 start_va = 0x20333300000 end_va = 0x203333fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020333300000" filename = "" Region: id = 695 start_va = 0x20333400000 end_va = 0x20333587fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333400000" filename = "" Region: id = 696 start_va = 0x20333590000 end_va = 0x20333710fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333590000" filename = "" Region: id = 697 start_va = 0x20333720000 end_va = 0x203337adfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 698 start_va = 0x203337b0000 end_va = 0x203337b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000203337b0000" filename = "" Region: id = 699 start_va = 0x203337c0000 end_va = 0x203337c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000203337c0000" filename = "" Region: id = 700 start_va = 0x203337d0000 end_va = 0x203338affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 701 start_va = 0x203338b0000 end_va = 0x203338b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000203338b0000" filename = "" Region: id = 702 start_va = 0x203338c0000 end_va = 0x203338c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000203338c0000" filename = "" Region: id = 703 start_va = 0x203338d0000 end_va = 0x203338e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 704 start_va = 0x203338f0000 end_va = 0x203338f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 705 start_va = 0x20333900000 end_va = 0x203339fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020333900000" filename = "" Region: id = 706 start_va = 0x20333a00000 end_va = 0x20333d36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 707 start_va = 0x20333d40000 end_va = 0x20333d44fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 708 start_va = 0x20333d50000 end_va = 0x20333d5ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 709 start_va = 0x20333d60000 end_va = 0x20333d62fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 710 start_va = 0x20333d70000 end_va = 0x20333d71fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 711 start_va = 0x20333d80000 end_va = 0x20333d89fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 712 start_va = 0x20333da0000 end_va = 0x20333da6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020333da0000" filename = "" Region: id = 713 start_va = 0x20333db0000 end_va = 0x20333dc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 714 start_va = 0x20333dd0000 end_va = 0x20333de0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 715 start_va = 0x20333df0000 end_va = 0x20333df6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020333df0000" filename = "" Region: id = 716 start_va = 0x20333e00000 end_va = 0x20333efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020333e00000" filename = "" Region: id = 717 start_va = 0x20333f00000 end_va = 0x20333f10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 718 start_va = 0x20333f20000 end_va = 0x20333f30fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 719 start_va = 0x20333f40000 end_va = 0x20333f50fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 720 start_va = 0x20333f60000 end_va = 0x20333f70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 721 start_va = 0x20333f80000 end_va = 0x20333f90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 722 start_va = 0x20333fa0000 end_va = 0x20333fc7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 723 start_va = 0x20333fe0000 end_va = 0x20333ff0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 724 start_va = 0x20334000000 end_va = 0x20334000fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usocore.dll.mui" filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui") Region: id = 725 start_va = 0x20334010000 end_va = 0x20334016fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334010000" filename = "" Region: id = 726 start_va = 0x20334020000 end_va = 0x20334050fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 727 start_va = 0x20334060000 end_va = 0x20334070fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 728 start_va = 0x20334080000 end_va = 0x203340b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 729 start_va = 0x203340c0000 end_va = 0x203340f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 730 start_va = 0x20334100000 end_va = 0x203341fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334100000" filename = "" Region: id = 731 start_va = 0x20334200000 end_va = 0x203342fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334200000" filename = "" Region: id = 732 start_va = 0x20334300000 end_va = 0x203343fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334300000" filename = "" Region: id = 733 start_va = 0x20334400000 end_va = 0x203344fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334400000" filename = "" Region: id = 734 start_va = 0x20334500000 end_va = 0x203345fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334500000" filename = "" Region: id = 735 start_va = 0x20334600000 end_va = 0x203346fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334600000" filename = "" Region: id = 736 start_va = 0x20334700000 end_va = 0x203347fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334700000" filename = "" Region: id = 737 start_va = 0x20334800000 end_va = 0x203348fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334800000" filename = "" Region: id = 738 start_va = 0x20334900000 end_va = 0x203349fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334900000" filename = "" Region: id = 739 start_va = 0x20334a00000 end_va = 0x20334afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334a00000" filename = "" Region: id = 740 start_va = 0x20334b00000 end_va = 0x20334bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334b00000" filename = "" Region: id = 741 start_va = 0x20334c00000 end_va = 0x20334c01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334c00000" filename = "" Region: id = 742 start_va = 0x20334c10000 end_va = 0x20334c27fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334c10000" filename = "" Region: id = 743 start_va = 0x20334cd0000 end_va = 0x20334cd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334cd0000" filename = "" Region: id = 744 start_va = 0x20334db0000 end_va = 0x20334db6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334db0000" filename = "" Region: id = 745 start_va = 0x20334dd0000 end_va = 0x20334dd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334dd0000" filename = "" Region: id = 746 start_va = 0x20334e00000 end_va = 0x20334efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334e00000" filename = "" Region: id = 747 start_va = 0x20334f00000 end_va = 0x20334ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020334f00000" filename = "" Region: id = 748 start_va = 0x20335000000 end_va = 0x203350fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335000000" filename = "" Region: id = 749 start_va = 0x20335100000 end_va = 0x203351fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335100000" filename = "" Region: id = 750 start_va = 0x20335200000 end_va = 0x203352fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335200000" filename = "" Region: id = 751 start_va = 0x20335300000 end_va = 0x203353fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335300000" filename = "" Region: id = 752 start_va = 0x20335400000 end_va = 0x203354fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335400000" filename = "" Region: id = 753 start_va = 0x20335500000 end_va = 0x203355fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335500000" filename = "" Region: id = 754 start_va = 0x20335600000 end_va = 0x203356fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335600000" filename = "" Region: id = 755 start_va = 0x20335700000 end_va = 0x203357fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335700000" filename = "" Region: id = 756 start_va = 0x20335800000 end_va = 0x203358fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335800000" filename = "" Region: id = 757 start_va = 0x20335900000 end_va = 0x203359fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335900000" filename = "" Region: id = 758 start_va = 0x20335a00000 end_va = 0x20335afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335a00000" filename = "" Region: id = 759 start_va = 0x20335b00000 end_va = 0x20335bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335b00000" filename = "" Region: id = 760 start_va = 0x20335c00000 end_va = 0x20335cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335c00000" filename = "" Region: id = 761 start_va = 0x20335d00000 end_va = 0x20335dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000020335d00000" filename = "" Region: id = 762 start_va = 0x7df5ffc50000 end_va = 0x7ff5ffc4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffc50000" filename = "" Region: id = 763 start_va = 0x7ff65acd0000 end_va = 0x7ff65adcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65acd0000" filename = "" Region: id = 764 start_va = 0x7ff65add0000 end_va = 0x7ff65adf2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65add0000" filename = "" Region: id = 765 start_va = 0x7ff65b180000 end_va = 0x7ff65b18cfff monitored = 0 entry_point = 0x7ff65b183980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 766 start_va = 0x7fffd4b60000 end_va = 0x7fffd4e0ffff monitored = 0 entry_point = 0x7fffd4b61cf0 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 767 start_va = 0x7fffd4e30000 end_va = 0x7fffd4e47fff monitored = 0 entry_point = 0x7fffd4e31b10 region_type = mapped_file name = "locationframeworkinternalps.dll" filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll") Region: id = 768 start_va = 0x7fffd4e80000 end_va = 0x7fffd4e87fff monitored = 0 entry_point = 0x7fffd4e813b0 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 769 start_va = 0x7fffd4e90000 end_va = 0x7fffd4ea6fff monitored = 0 entry_point = 0x7fffd4e97520 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 770 start_va = 0x7fffd4eb0000 end_va = 0x7fffd4f84fff monitored = 0 entry_point = 0x7fffd4eccf80 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 771 start_va = 0x7fffd4fe0000 end_va = 0x7fffd5023fff monitored = 0 entry_point = 0x7fffd50083e0 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 772 start_va = 0x7fffd5030000 end_va = 0x7fffd5051fff monitored = 0 entry_point = 0x7fffd5042540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 773 start_va = 0x7fffd5060000 end_va = 0x7fffd50bcfff monitored = 0 entry_point = 0x7fffd508e510 region_type = mapped_file name = "usocore.dll" filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll") Region: id = 774 start_va = 0x7fffd6b00000 end_va = 0x7fffd6b3efff monitored = 0 entry_point = 0x7fffd6b282d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 775 start_va = 0x7fffd6f40000 end_va = 0x7fffd6f57fff monitored = 0 entry_point = 0x7fffd6f4b850 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 776 start_va = 0x7fffd6fa0000 end_va = 0x7fffd6fd5fff monitored = 0 entry_point = 0x7fffd6fa27f0 region_type = mapped_file name = "windows.networking.hostname.dll" filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll") Region: id = 777 start_va = 0x7fffd6fe0000 end_va = 0x7fffd70eefff monitored = 0 entry_point = 0x7fffd701c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 778 start_va = 0x7fffd7e80000 end_va = 0x7fffd7ee6fff monitored = 0 entry_point = 0x7fffd7e8b160 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 779 start_va = 0x7fffd8aa0000 end_va = 0x7fffd8bbcfff monitored = 0 entry_point = 0x7fffd8acfe60 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 780 start_va = 0x7fffd9060000 end_va = 0x7fffd90a5fff monitored = 0 entry_point = 0x7fffd90679a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 781 start_va = 0x7fffdb330000 end_va = 0x7fffdb339fff monitored = 0 entry_point = 0x7fffdb331350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 782 start_va = 0x7fffdb3b0000 end_va = 0x7fffdb3c1fff monitored = 0 entry_point = 0x7fffdb3b1a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 783 start_va = 0x7fffdb7d0000 end_va = 0x7fffdb7e3fff monitored = 0 entry_point = 0x7fffdb7d3710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 784 start_va = 0x7fffdb880000 end_va = 0x7fffdb89dfff monitored = 0 entry_point = 0x7fffdb88ef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 785 start_va = 0x7fffdba60000 end_va = 0x7fffdba75fff monitored = 0 entry_point = 0x7fffdba61d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 786 start_va = 0x7fffdbbb0000 end_va = 0x7fffdbbc5fff monitored = 0 entry_point = 0x7fffdbbb1af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 787 start_va = 0x7fffdbbd0000 end_va = 0x7fffdbbe9fff monitored = 0 entry_point = 0x7fffdbbd2330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 788 start_va = 0x7fffdbbf0000 end_va = 0x7fffdbc00fff monitored = 0 entry_point = 0x7fffdbbf7480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 789 start_va = 0x7fffdbc10000 end_va = 0x7fffdbc93fff monitored = 0 entry_point = 0x7fffdbc28d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 790 start_va = 0x7fffdbca0000 end_va = 0x7fffdbcb5fff monitored = 0 entry_point = 0x7fffdbca55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 791 start_va = 0x7fffdbcc0000 end_va = 0x7fffdbd95fff monitored = 0 entry_point = 0x7fffdbcea800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 792 start_va = 0x7fffdbda0000 end_va = 0x7fffdbdaefff monitored = 0 entry_point = 0x7fffdbda4960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 793 start_va = 0x7fffdbdb0000 end_va = 0x7fffdbe13fff monitored = 0 entry_point = 0x7fffdbdcbed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 794 start_va = 0x7fffdbe20000 end_va = 0x7fffdbe44fff monitored = 0 entry_point = 0x7fffdbe29900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 795 start_va = 0x7fffdbe90000 end_va = 0x7fffdbf85fff monitored = 0 entry_point = 0x7fffdbec9590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 796 start_va = 0x7fffdbf90000 end_va = 0x7fffdc003fff monitored = 0 entry_point = 0x7fffdbfa5eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 797 start_va = 0x7fffdc010000 end_va = 0x7fffdc146fff monitored = 0 entry_point = 0x7fffdc050480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 798 start_va = 0x7fffdc180000 end_va = 0x7fffdc18cfff monitored = 0 entry_point = 0x7fffdc181420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 799 start_va = 0x7fffdc1c0000 end_va = 0x7fffdc1d0fff monitored = 0 entry_point = 0x7fffdc1c2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 800 start_va = 0x7fffdc1e0000 end_va = 0x7fffdc1fdfff monitored = 0 entry_point = 0x7fffdc1e3a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 801 start_va = 0x7fffdc200000 end_va = 0x7fffdc281fff monitored = 0 entry_point = 0x7fffdc202a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 802 start_va = 0x7fffdc430000 end_va = 0x7fffdc43bfff monitored = 0 entry_point = 0x7fffdc4335c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 803 start_va = 0x7fffdc490000 end_va = 0x7fffdc4cffff monitored = 0 entry_point = 0x7fffdc49cbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 804 start_va = 0x7fffdc4d0000 end_va = 0x7fffdc516fff monitored = 0 entry_point = 0x7fffdc4d1d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 805 start_va = 0x7fffdc580000 end_va = 0x7fffdc5c1fff monitored = 0 entry_point = 0x7fffdc583670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 806 start_va = 0x7fffdc860000 end_va = 0x7fffdc87efff monitored = 0 entry_point = 0x7fffdc8637e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 807 start_va = 0x7fffdc880000 end_va = 0x7fffdc8f8fff monitored = 0 entry_point = 0x7fffdc8876a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 808 start_va = 0x7fffdc990000 end_va = 0x7fffdca32fff monitored = 0 entry_point = 0x7fffdc992c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 809 start_va = 0x7fffdca40000 end_va = 0x7fffdca91fff monitored = 0 entry_point = 0x7fffdca45770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 810 start_va = 0x7fffdcaa0000 end_va = 0x7fffdcab7fff monitored = 0 entry_point = 0x7fffdcaa4e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 811 start_va = 0x7fffdcac0000 end_va = 0x7fffdcae4fff monitored = 0 entry_point = 0x7fffdcac5ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 812 start_va = 0x7fffdcaf0000 end_va = 0x7fffdcb1dfff monitored = 1 entry_point = 0x7fffdcaf2300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 813 start_va = 0x7fffdcb20000 end_va = 0x7fffdcb7dfff monitored = 0 entry_point = 0x7fffdcb25080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 814 start_va = 0x7fffdcb80000 end_va = 0x7fffdcb9ffff monitored = 0 entry_point = 0x7fffdcb81f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 815 start_va = 0x7fffdcba0000 end_va = 0x7fffdcba8fff monitored = 0 entry_point = 0x7fffdcba18f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 816 start_va = 0x7fffdcbb0000 end_va = 0x7fffdcbc0fff monitored = 0 entry_point = 0x7fffdcbb1d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 817 start_va = 0x7fffdcbe0000 end_va = 0x7fffdcc20fff monitored = 0 entry_point = 0x7fffdcbe3750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 818 start_va = 0x7fffdcc30000 end_va = 0x7fffdcd22fff monitored = 0 entry_point = 0x7fffdcc55d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 819 start_va = 0x7fffdedb0000 end_va = 0x7fffdedfbfff monitored = 0 entry_point = 0x7fffdedc5310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 820 start_va = 0x7fffdee20000 end_va = 0x7fffdee37fff monitored = 0 entry_point = 0x7fffdee22000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 821 start_va = 0x7fffdee40000 end_va = 0x7fffdefc1fff monitored = 0 entry_point = 0x7fffdee582a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 822 start_va = 0x7fffdf030000 end_va = 0x7fffdf0aefff monitored = 0 entry_point = 0x7fffdf047110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 823 start_va = 0x7fffdf0b0000 end_va = 0x7fffdf0ebfff monitored = 0 entry_point = 0x7fffdf0b6aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 824 start_va = 0x7fffdfc70000 end_va = 0x7fffdfca4fff monitored = 0 entry_point = 0x7fffdfc7a270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 825 start_va = 0x7fffe1b10000 end_va = 0x7fffe1b4ffff monitored = 0 entry_point = 0x7fffe1b26c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 826 start_va = 0x7fffe1b50000 end_va = 0x7fffe1b58fff monitored = 0 entry_point = 0x7fffe1b521d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 827 start_va = 0x7fffe49b0000 end_va = 0x7fffe49e1fff monitored = 0 entry_point = 0x7fffe49bb0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 828 start_va = 0x7fffe4f60000 end_va = 0x7fffe4f71fff monitored = 0 entry_point = 0x7fffe4f63580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 829 start_va = 0x7fffe4ff0000 end_va = 0x7fffe500afff monitored = 0 entry_point = 0x7fffe4ff1040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 830 start_va = 0x7fffe5010000 end_va = 0x7fffe5019fff monitored = 0 entry_point = 0x7fffe50114c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 831 start_va = 0x7fffe51f0000 end_va = 0x7fffe526ffff monitored = 0 entry_point = 0x7fffe521d280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 832 start_va = 0x7fffe5270000 end_va = 0x7fffe527bfff monitored = 0 entry_point = 0x7fffe5272830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 833 start_va = 0x7fffe5280000 end_va = 0x7fffe528dfff monitored = 0 entry_point = 0x7fffe5281460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 834 start_va = 0x7fffe5290000 end_va = 0x7fffe52a4fff monitored = 0 entry_point = 0x7fffe5292dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 835 start_va = 0x7fffe5420000 end_va = 0x7fffe542ffff monitored = 0 entry_point = 0x7fffe5421700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 836 start_va = 0x7fffe5430000 end_va = 0x7fffe5438fff monitored = 0 entry_point = 0x7fffe5431ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 837 start_va = 0x7fffe5440000 end_va = 0x7fffe546cfff monitored = 0 entry_point = 0x7fffe5442290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 838 start_va = 0x7fffe5470000 end_va = 0x7fffe54c1fff monitored = 0 entry_point = 0x7fffe54738e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 839 start_va = 0x7fffe54d0000 end_va = 0x7fffe5569fff monitored = 0 entry_point = 0x7fffe54eada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 840 start_va = 0x7fffe5710000 end_va = 0x7fffe5776fff monitored = 0 entry_point = 0x7fffe57163e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 841 start_va = 0x7fffe57d0000 end_va = 0x7fffe57e4fff monitored = 0 entry_point = 0x7fffe57d3460 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 842 start_va = 0x7fffe58c0000 end_va = 0x7fffe597ffff monitored = 0 entry_point = 0x7fffe58efd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 843 start_va = 0x7fffe5a90000 end_va = 0x7fffe5ad0fff monitored = 0 entry_point = 0x7fffe5a94840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 844 start_va = 0x7fffe5bb0000 end_va = 0x7fffe5bc9fff monitored = 0 entry_point = 0x7fffe5bb2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 845 start_va = 0x7fffe5bd0000 end_va = 0x7fffe5be5fff monitored = 0 entry_point = 0x7fffe5bd19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 846 start_va = 0x7fffe5d70000 end_va = 0x7fffe5da7fff monitored = 0 entry_point = 0x7fffe5d88cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 847 start_va = 0x7fffe5e50000 end_va = 0x7fffe5e63fff monitored = 0 entry_point = 0x7fffe5e52d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 848 start_va = 0x7fffe61e0000 end_va = 0x7fffe6272fff monitored = 0 entry_point = 0x7fffe61e9680 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 849 start_va = 0x7fffe6390000 end_va = 0x7fffe639afff monitored = 0 entry_point = 0x7fffe6391d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 850 start_va = 0x7fffe63f0000 end_va = 0x7fffe6408fff monitored = 0 entry_point = 0x7fffe63f4520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 851 start_va = 0x7fffe68b0000 end_va = 0x7fffe6995fff monitored = 0 entry_point = 0x7fffe68ccf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 852 start_va = 0x7fffe6b80000 end_va = 0x7fffe6bbdfff monitored = 0 entry_point = 0x7fffe6b8a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 853 start_va = 0x7fffe6bc0000 end_va = 0x7fffe6be6fff monitored = 0 entry_point = 0x7fffe6bc3bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 854 start_va = 0x7fffe6c50000 end_va = 0x7fffe6c7dfff monitored = 0 entry_point = 0x7fffe6c57550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 855 start_va = 0x7fffe6c80000 end_va = 0x7fffe6c95fff monitored = 0 entry_point = 0x7fffe6c81b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 856 start_va = 0x7fffe6ca0000 end_va = 0x7fffe6cacfff monitored = 0 entry_point = 0x7fffe6ca2ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 857 start_va = 0x7fffe6cb0000 end_va = 0x7fffe6cdefff monitored = 0 entry_point = 0x7fffe6cb8910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 858 start_va = 0x7fffe6ea0000 end_va = 0x7fffe6fd5fff monitored = 0 entry_point = 0x7fffe6ecf350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 859 start_va = 0x7fffe6fe0000 end_va = 0x7fffe7361fff monitored = 0 entry_point = 0x7fffe7031220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 860 start_va = 0x7fffe8460000 end_va = 0x7fffe856dfff monitored = 0 entry_point = 0x7fffe84aeaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 861 start_va = 0x7fffe8870000 end_va = 0x7fffe8886fff monitored = 0 entry_point = 0x7fffe8875630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 862 start_va = 0x7fffe8890000 end_va = 0x7fffe889ffff monitored = 0 entry_point = 0x7fffe8892c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 863 start_va = 0x7fffe88a0000 end_va = 0x7fffe8919fff monitored = 0 entry_point = 0x7fffe88c7630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 864 start_va = 0x7fffe8920000 end_va = 0x7fffe8932fff monitored = 0 entry_point = 0x7fffe89257f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 865 start_va = 0x7fffe8940000 end_va = 0x7fffe8994fff monitored = 0 entry_point = 0x7fffe894fc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 866 start_va = 0x7fffe8a00000 end_va = 0x7fffe8a6dfff monitored = 0 entry_point = 0x7fffe8a07f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 867 start_va = 0x7fffe8a70000 end_va = 0x7fffe8ad3fff monitored = 0 entry_point = 0x7fffe8a85ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 868 start_va = 0x7fffe8ca0000 end_va = 0x7fffe8cb0fff monitored = 0 entry_point = 0x7fffe8ca3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 869 start_va = 0x7fffe8cc0000 end_va = 0x7fffe8d00fff monitored = 0 entry_point = 0x7fffe8cd7eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 870 start_va = 0x7fffe8d10000 end_va = 0x7fffe8e0bfff monitored = 0 entry_point = 0x7fffe8d46df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 871 start_va = 0x7fffe8e10000 end_va = 0x7fffe8ecefff monitored = 0 entry_point = 0x7fffe8e31c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 872 start_va = 0x7fffe8ed0000 end_va = 0x7fffe8f7dfff monitored = 0 entry_point = 0x7fffe8ee80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 873 start_va = 0x7fffe8f80000 end_va = 0x7fffe8f91fff monitored = 0 entry_point = 0x7fffe8f89260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 874 start_va = 0x7fffe8fa0000 end_va = 0x7fffe9050fff monitored = 0 entry_point = 0x7fffe90188b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 875 start_va = 0x7fffe9060000 end_va = 0x7fffe9069fff monitored = 0 entry_point = 0x7fffe9061660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 876 start_va = 0x7fffe9070000 end_va = 0x7fffe91bcfff monitored = 0 entry_point = 0x7fffe90b3da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 877 start_va = 0x7fffe91c0000 end_va = 0x7fffe91d7fff monitored = 0 entry_point = 0x7fffe91c5910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 878 start_va = 0x7fffe91e0000 end_va = 0x7fffe9204fff monitored = 0 entry_point = 0x7fffe91f2f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 879 start_va = 0x7fffe9210000 end_va = 0x7fffe9220fff monitored = 0 entry_point = 0x7fffe9217ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 880 start_va = 0x7fffe9230000 end_va = 0x7fffe9249fff monitored = 0 entry_point = 0x7fffe9232cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 881 start_va = 0x7fffe9250000 end_va = 0x7fffe92a4fff monitored = 0 entry_point = 0x7fffe9253fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 882 start_va = 0x7fffe92b0000 end_va = 0x7fffe92e6fff monitored = 0 entry_point = 0x7fffe92b6020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 883 start_va = 0x7fffe92f0000 end_va = 0x7fffe92fbfff monitored = 0 entry_point = 0x7fffe92f14d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 884 start_va = 0x7fffe9300000 end_va = 0x7fffe931ffff monitored = 0 entry_point = 0x7fffe93039a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 885 start_va = 0x7fffe9320000 end_va = 0x7fffe93e7fff monitored = 0 entry_point = 0x7fffe93613f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 886 start_va = 0x7fffe93f0000 end_va = 0x7fffe9450fff monitored = 0 entry_point = 0x7fffe93f4b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 887 start_va = 0x7fffe9460000 end_va = 0x7fffe95dbfff monitored = 0 entry_point = 0x7fffe94b1650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 888 start_va = 0x7fffe95e0000 end_va = 0x7fffe95eafff monitored = 0 entry_point = 0x7fffe95e1770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 889 start_va = 0x7fffe9f30000 end_va = 0x7fffe9fc1fff monitored = 0 entry_point = 0x7fffe9f7a780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 890 start_va = 0x7fffea070000 end_va = 0x7fffea0a5fff monitored = 0 entry_point = 0x7fffea080070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 891 start_va = 0x7fffea0b0000 end_va = 0x7fffea0cefff monitored = 0 entry_point = 0x7fffea0b4960 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 892 start_va = 0x7fffeac00000 end_va = 0x7fffeac0afff monitored = 0 entry_point = 0x7fffeac01de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 893 start_va = 0x7fffeac30000 end_va = 0x7fffeac43fff monitored = 0 entry_point = 0x7fffeac32a00 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 894 start_va = 0x7fffeacf0000 end_va = 0x7fffeb182fff monitored = 0 entry_point = 0x7fffeacff760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 895 start_va = 0x7fffeb190000 end_va = 0x7fffeb1f6fff monitored = 0 entry_point = 0x7fffeb1ae710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 896 start_va = 0x7fffeb250000 end_va = 0x7fffeb2c8fff monitored = 0 entry_point = 0x7fffeb26fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 897 start_va = 0x7fffeb2d0000 end_va = 0x7fffeb2d7fff monitored = 0 entry_point = 0x7fffeb2d13e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 898 start_va = 0x7fffeb310000 end_va = 0x7fffeb495fff monitored = 0 entry_point = 0x7fffeb35d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 899 start_va = 0x7fffeb4a0000 end_va = 0x7fffeb4bbfff monitored = 0 entry_point = 0x7fffeb4a37a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 900 start_va = 0x7fffeb4e0000 end_va = 0x7fffeb4f3fff monitored = 0 entry_point = 0x7fffeb4e1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 901 start_va = 0x7fffeb500000 end_va = 0x7fffeb512fff monitored = 0 entry_point = 0x7fffeb502760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 902 start_va = 0x7fffeb610000 end_va = 0x7fffeb620fff monitored = 0 entry_point = 0x7fffeb6128d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 903 start_va = 0x7fffeb650000 end_va = 0x7fffeb66cfff monitored = 0 entry_point = 0x7fffeb654f60 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 904 start_va = 0x7fffeb670000 end_va = 0x7fffeb6affff monitored = 0 entry_point = 0x7fffeb681960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 905 start_va = 0x7fffeb7e0000 end_va = 0x7fffeb806fff monitored = 0 entry_point = 0x7fffeb7e7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 906 start_va = 0x7fffeb830000 end_va = 0x7fffeb8d9fff monitored = 0 entry_point = 0x7fffeb857910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 907 start_va = 0x7fffeb8e0000 end_va = 0x7fffeb9dffff monitored = 0 entry_point = 0x7fffeb920f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 908 start_va = 0x7fffeba70000 end_va = 0x7fffeba7bfff monitored = 0 entry_point = 0x7fffeba72480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 909 start_va = 0x7fffebc40000 end_va = 0x7fffebc71fff monitored = 0 entry_point = 0x7fffebc52340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 910 start_va = 0x7fffebdb0000 end_va = 0x7fffebdbbfff monitored = 0 entry_point = 0x7fffebdb2790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 911 start_va = 0x7fffebdc0000 end_va = 0x7fffebde3fff monitored = 0 entry_point = 0x7fffebdc3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 912 start_va = 0x7fffebf60000 end_va = 0x7fffec053fff monitored = 0 entry_point = 0x7fffebf6a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 913 start_va = 0x7fffec0b0000 end_va = 0x7fffec0f8fff monitored = 0 entry_point = 0x7fffec0ba090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 914 start_va = 0x7fffec1d0000 end_va = 0x7fffec1dbfff monitored = 0 entry_point = 0x7fffec1d27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 915 start_va = 0x7fffec2b0000 end_va = 0x7fffec2e0fff monitored = 0 entry_point = 0x7fffec2b7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 916 start_va = 0x7fffec310000 end_va = 0x7fffec389fff monitored = 0 entry_point = 0x7fffec331a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 917 start_va = 0x7fffec3d0000 end_va = 0x7fffec403fff monitored = 0 entry_point = 0x7fffec3eae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 918 start_va = 0x7fffec410000 end_va = 0x7fffec419fff monitored = 0 entry_point = 0x7fffec411830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 919 start_va = 0x7fffec520000 end_va = 0x7fffec53efff monitored = 0 entry_point = 0x7fffec525d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 920 start_va = 0x7fffec690000 end_va = 0x7fffec6ebfff monitored = 0 entry_point = 0x7fffec6a6f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 921 start_va = 0x7fffec740000 end_va = 0x7fffec756fff monitored = 0 entry_point = 0x7fffec7479d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 922 start_va = 0x7fffec860000 end_va = 0x7fffec86afff monitored = 0 entry_point = 0x7fffec8619a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 923 start_va = 0x7fffec8a0000 end_va = 0x7fffec8c0fff monitored = 0 entry_point = 0x7fffec8b0250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 924 start_va = 0x7fffec8f0000 end_va = 0x7fffec929fff monitored = 0 entry_point = 0x7fffec8f8d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 925 start_va = 0x7fffec930000 end_va = 0x7fffec956fff monitored = 0 entry_point = 0x7fffec940aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 926 start_va = 0x7fffec960000 end_va = 0x7fffec9b5fff monitored = 0 entry_point = 0x7fffec970bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 927 start_va = 0x7fffecaa0000 end_va = 0x7fffecaccfff monitored = 0 entry_point = 0x7fffecab9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 928 start_va = 0x7fffecc30000 end_va = 0x7fffecc48fff monitored = 0 entry_point = 0x7fffecc35e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 929 start_va = 0x7fffecc50000 end_va = 0x7fffecc78fff monitored = 0 entry_point = 0x7fffecc64530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 930 start_va = 0x7fffecc80000 end_va = 0x7fffecd18fff monitored = 0 entry_point = 0x7fffeccaf4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 931 start_va = 0x7fffecdc0000 end_va = 0x7fffecdd3fff monitored = 0 entry_point = 0x7fffecdc52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 932 start_va = 0x7fffecde0000 end_va = 0x7fffece2afff monitored = 0 entry_point = 0x7fffecde35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 933 start_va = 0x7fffece30000 end_va = 0x7fffece3ffff monitored = 0 entry_point = 0x7fffece356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 934 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 935 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 936 start_va = 0x7fffed0f0000 end_va = 0x7fffed733fff monitored = 0 entry_point = 0x7fffed2b64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 937 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 938 start_va = 0x7fffed7b0000 end_va = 0x7fffed804fff monitored = 0 entry_point = 0x7fffed7c7970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 939 start_va = 0x7fffed810000 end_va = 0x7fffed8c4fff monitored = 0 entry_point = 0x7fffed8522e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 940 start_va = 0x7fffed8d0000 end_va = 0x7fffed8e6fff monitored = 0 entry_point = 0x7fffed8d1390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 941 start_va = 0x7fffed8f0000 end_va = 0x7fffed932fff monitored = 0 entry_point = 0x7fffed904b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 942 start_va = 0x7fffed940000 end_va = 0x7fffedb06fff monitored = 0 entry_point = 0x7fffed99db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 943 start_va = 0x7fffedb10000 end_va = 0x7fffedb95fff monitored = 0 entry_point = 0x7fffedb1d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 944 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 945 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 946 start_va = 0x7fffede30000 end_va = 0x7fffeded6fff monitored = 0 entry_point = 0x7fffede3b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 947 start_va = 0x7fffedee0000 end_va = 0x7fffedf31fff monitored = 0 entry_point = 0x7fffedeef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 948 start_va = 0x7fffee060000 end_va = 0x7fffef5befff monitored = 0 entry_point = 0x7fffee1c11f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 949 start_va = 0x7fffef5c0000 end_va = 0x7fffef9e8fff monitored = 0 entry_point = 0x7fffef5e8740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 950 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 951 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 952 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 953 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 954 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 955 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 956 start_va = 0x7ffff04d0000 end_va = 0x7ffff052bfff monitored = 0 entry_point = 0x7ffff04eb720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 957 start_va = 0x7ffff0530000 end_va = 0x7ffff0537fff monitored = 0 entry_point = 0x7ffff0531ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 958 start_va = 0x7ffff0540000 end_va = 0x7ffff05aafff monitored = 0 entry_point = 0x7ffff05590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 959 start_va = 0x7ffff05b0000 end_va = 0x7ffff06f2fff monitored = 0 entry_point = 0x7ffff05d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 960 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 961 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1036 start_va = 0xf90b200000 end_va = 0xf90b2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90b200000" filename = "" Region: id = 1037 start_va = 0xf90b300000 end_va = 0xf90b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90b300000" filename = "" Region: id = 1125 start_va = 0x20333d90000 end_va = 0x20333d91fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 1270 start_va = 0x20333d90000 end_va = 0x20333d94fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 1272 start_va = 0x20333d90000 end_va = 0x20333d94fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 1893 start_va = 0x20333d90000 end_va = 0x20333d91fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 1894 start_va = 0x20333d90000 end_va = 0x20333d92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 1895 start_va = 0x20333fd0000 end_va = 0x20333fd1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333fd0000" filename = "" Region: id = 1896 start_va = 0x20333d90000 end_va = 0x20333d92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 1900 start_va = 0x20334c30000 end_va = 0x20334c42fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334c30000" filename = "" Region: id = 1908 start_va = 0x20334c30000 end_va = 0x20334c42fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334c30000" filename = "" Region: id = 1911 start_va = 0x20333d90000 end_va = 0x20333d92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 1912 start_va = 0x20333d90000 end_va = 0x20333d93fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 1913 start_va = 0x20334c30000 end_va = 0x20334c32fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020334c30000" filename = "" Region: id = 1999 start_va = 0x20333d90000 end_va = 0x20333d92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 2017 start_va = 0x20333d90000 end_va = 0x20333d92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 2024 start_va = 0x20333d90000 end_va = 0x20333d91fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 2025 start_va = 0x20333d90000 end_va = 0x20333d92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 2026 start_va = 0x20333d90000 end_va = 0x20333d92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 2118 start_va = 0x20333d90000 end_va = 0x20333d90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 2340 start_va = 0xf90b400000 end_va = 0xf90b4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90b400000" filename = "" Region: id = 2532 start_va = 0x20333d90000 end_va = 0x20333d91fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 2533 start_va = 0x20333d90000 end_va = 0x20333d90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 2534 start_va = 0x20333d90000 end_va = 0x20333d90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 2537 start_va = 0xf90b500000 end_va = 0xf90b5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90b500000" filename = "" Region: id = 2538 start_va = 0xf90b600000 end_va = 0xf90b6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90b600000" filename = "" Region: id = 2539 start_va = 0x20333d90000 end_va = 0x20333d90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 2540 start_va = 0x20333d90000 end_va = 0x20333d91fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000020333d90000" filename = "" Region: id = 2541 start_va = 0xf90b700000 end_va = 0xf90b7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90b700000" filename = "" Region: id = 2542 start_va = 0x20333d90000 end_va = 0x20333d9bfff monitored = 0 entry_point = 0x20333d92a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 2545 start_va = 0xf90b800000 end_va = 0xf90b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90b800000" filename = "" Region: id = 2546 start_va = 0xf90b900000 end_va = 0xf90b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90b900000" filename = "" Region: id = 2548 start_va = 0xf90ba00000 end_va = 0xf90bafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90ba00000" filename = "" Region: id = 2549 start_va = 0xf90bb00000 end_va = 0xf90bbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90bb00000" filename = "" Region: id = 2550 start_va = 0xf90bc00000 end_va = 0xf90bcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90bc00000" filename = "" Region: id = 2552 start_va = 0xf90bd00000 end_va = 0xf90bdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90bd00000" filename = "" Region: id = 2553 start_va = 0xf90be00000 end_va = 0xf90befffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90be00000" filename = "" Region: id = 2554 start_va = 0xf90bf00000 end_va = 0xf90bffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90bf00000" filename = "" Region: id = 2555 start_va = 0xf90c000000 end_va = 0xf90c0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90c000000" filename = "" Region: id = 2556 start_va = 0xf90c100000 end_va = 0xf90c1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000f90c100000" filename = "" Thread: id = 18 os_tid = 0x12a8 Thread: id = 19 os_tid = 0x1294 Thread: id = 20 os_tid = 0xd48 Thread: id = 21 os_tid = 0xcf4 Thread: id = 22 os_tid = 0x11e8 Thread: id = 23 os_tid = 0x1138 Thread: id = 24 os_tid = 0x1134 Thread: id = 25 os_tid = 0x112c Thread: id = 26 os_tid = 0x10dc Thread: id = 27 os_tid = 0x107c Thread: id = 28 os_tid = 0x348 Thread: id = 29 os_tid = 0xbe4 Thread: id = 30 os_tid = 0x5fc Thread: id = 31 os_tid = 0x968 Thread: id = 32 os_tid = 0x49c Thread: id = 33 os_tid = 0x498 Thread: id = 34 os_tid = 0x648 Thread: id = 35 os_tid = 0x57c Thread: id = 36 os_tid = 0xb54 Thread: id = 37 os_tid = 0xa0c Thread: id = 38 os_tid = 0xae8 Thread: id = 39 os_tid = 0x4f8 Thread: id = 40 os_tid = 0xaa4 Thread: id = 41 os_tid = 0x3c0 Thread: id = 42 os_tid = 0x8ec Thread: id = 43 os_tid = 0x338 Thread: id = 44 os_tid = 0x390 Thread: id = 45 os_tid = 0xb8 Thread: id = 46 os_tid = 0xa40 Thread: id = 47 os_tid = 0xb80 Thread: id = 48 os_tid = 0x290 Thread: id = 49 os_tid = 0x464 Thread: id = 50 os_tid = 0x530 Thread: id = 51 os_tid = 0xb38 Thread: id = 52 os_tid = 0x69c Thread: id = 53 os_tid = 0x534 Thread: id = 54 os_tid = 0x5c8 Thread: id = 55 os_tid = 0x63c Thread: id = 56 os_tid = 0xab4 Thread: id = 57 os_tid = 0xbe8 Thread: id = 58 os_tid = 0xbd8 Thread: id = 59 os_tid = 0x718 Thread: id = 60 os_tid = 0x724 Thread: id = 61 os_tid = 0xbd4 Thread: id = 62 os_tid = 0xbd0 Thread: id = 63 os_tid = 0x3fc Thread: id = 64 os_tid = 0x714 Thread: id = 65 os_tid = 0x1cc Thread: id = 66 os_tid = 0xa38 Thread: id = 67 os_tid = 0x614 Thread: id = 68 os_tid = 0x434 Thread: id = 69 os_tid = 0x928 Thread: id = 70 os_tid = 0xa58 Thread: id = 71 os_tid = 0x804 Thread: id = 72 os_tid = 0x5a0 Thread: id = 73 os_tid = 0x9c4 Thread: id = 74 os_tid = 0x97c Thread: id = 75 os_tid = 0x970 Thread: id = 76 os_tid = 0x950 Thread: id = 77 os_tid = 0x918 Thread: id = 78 os_tid = 0x910 Thread: id = 79 os_tid = 0x904 Thread: id = 80 os_tid = 0x8f8 Thread: id = 81 os_tid = 0x8f0 Thread: id = 82 os_tid = 0x8e4 Thread: id = 83 os_tid = 0x8c0 Thread: id = 84 os_tid = 0x8b8 Thread: id = 85 os_tid = 0x8b0 Thread: id = 86 os_tid = 0x858 Thread: id = 87 os_tid = 0x814 Thread: id = 88 os_tid = 0x520 Thread: id = 89 os_tid = 0x580 Thread: id = 90 os_tid = 0x498 Thread: id = 91 os_tid = 0x6cc Thread: id = 92 os_tid = 0x68c Thread: id = 93 os_tid = 0x66c Thread: id = 94 os_tid = 0x504 Thread: id = 95 os_tid = 0x4e8 Thread: id = 96 os_tid = 0x4b4 Thread: id = 97 os_tid = 0x430 Thread: id = 98 os_tid = 0x408 Thread: id = 99 os_tid = 0x2d0 Thread: id = 100 os_tid = 0x270 Thread: id = 101 os_tid = 0x160 Thread: id = 102 os_tid = 0x1c8 Thread: id = 103 os_tid = 0x174 Thread: id = 104 os_tid = 0x158 Thread: id = 105 os_tid = 0x144 Thread: id = 106 os_tid = 0x148 Thread: id = 107 os_tid = 0x128 Thread: id = 108 os_tid = 0x124 Thread: id = 109 os_tid = 0xf8 Thread: id = 110 os_tid = 0x3f8 Thread: id = 129 os_tid = 0x1384 Thread: id = 130 os_tid = 0x1360 Thread: id = 171 os_tid = 0xc60 Thread: id = 203 os_tid = 0xc6c Thread: id = 204 os_tid = 0x468 Thread: id = 205 os_tid = 0xf74 Thread: id = 208 os_tid = 0xfbc Thread: id = 209 os_tid = 0xfd0 Thread: id = 211 os_tid = 0xff0 Thread: id = 212 os_tid = 0x9b0 Thread: id = 213 os_tid = 0x100c Thread: id = 215 os_tid = 0x590 Thread: id = 216 os_tid = 0xb9c Thread: id = 217 os_tid = 0xc9c Thread: id = 218 os_tid = 0xc90 Thread: id = 219 os_tid = 0xc94 Process: id = "4" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x44328000" os_pid = "0x11c4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000552cc" [0xc000000f] Region: id = 1039 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1040 start_va = 0x9dcfcc0000 end_va = 0x9dcfd3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000009dcfcc0000" filename = "" Region: id = 1041 start_va = 0x9dcfe00000 end_va = 0x9dcfffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000009dcfe00000" filename = "" Region: id = 1042 start_va = 0x9dd0000000 end_va = 0x9dd007ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000009dd0000000" filename = "" Region: id = 1043 start_va = 0x9dd0080000 end_va = 0x9dd00fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000009dd0080000" filename = "" Region: id = 1044 start_va = 0x9dd0100000 end_va = 0x9dd017ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000009dd0100000" filename = "" Region: id = 1045 start_va = 0x9dd0180000 end_va = 0x9dd01fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000009dd0180000" filename = "" Region: id = 1046 start_va = 0x9dd0200000 end_va = 0x9dd027ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000009dd0200000" filename = "" Region: id = 1047 start_va = 0x9dd0280000 end_va = 0x9dd02fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000009dd0280000" filename = "" Region: id = 1048 start_va = 0x9dd0300000 end_va = 0x9dd037ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000009dd0300000" filename = "" Region: id = 1049 start_va = 0x9dd0380000 end_va = 0x9dd03fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000009dd0380000" filename = "" Region: id = 1050 start_va = 0x23f3e8a0000 end_va = 0x23f3e8affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3e8a0000" filename = "" Region: id = 1051 start_va = 0x23f3e8b0000 end_va = 0x23f3e8b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023f3e8b0000" filename = "" Region: id = 1052 start_va = 0x23f3e8c0000 end_va = 0x23f3e8d4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3e8c0000" filename = "" Region: id = 1053 start_va = 0x23f3e8e0000 end_va = 0x23f3e8e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3e8e0000" filename = "" Region: id = 1054 start_va = 0x23f3e8f0000 end_va = 0x23f3e8f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3e8f0000" filename = "" Region: id = 1055 start_va = 0x23f3e900000 end_va = 0x23f3e901fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023f3e900000" filename = "" Region: id = 1056 start_va = 0x23f3e910000 end_va = 0x23f3e916fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023f3e910000" filename = "" Region: id = 1057 start_va = 0x23f3e920000 end_va = 0x23f3e920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023f3e920000" filename = "" Region: id = 1058 start_va = 0x23f3e930000 end_va = 0x23f3e930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023f3e930000" filename = "" Region: id = 1059 start_va = 0x23f3e940000 end_va = 0x23f3e944fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1060 start_va = 0x23f3e950000 end_va = 0x23f3e950fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3e950000" filename = "" Region: id = 1061 start_va = 0x23f3e960000 end_va = 0x23f3e960fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3e960000" filename = "" Region: id = 1062 start_va = 0x23f3e970000 end_va = 0x23f3e970fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3e970000" filename = "" Region: id = 1063 start_va = 0x23f3e980000 end_va = 0x23f3e982fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 1064 start_va = 0x23f3e9a0000 end_va = 0x23f3ea9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023f3e9a0000" filename = "" Region: id = 1065 start_va = 0x23f3eaa0000 end_va = 0x23f3eb5dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1066 start_va = 0x23f3eb60000 end_va = 0x23f3ece7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3eb60000" filename = "" Region: id = 1067 start_va = 0x23f3ecf0000 end_va = 0x23f3ecf2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 1068 start_va = 0x23f3ed20000 end_va = 0x23f3ed22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 1069 start_va = 0x23f3ed40000 end_va = 0x23f3ed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023f3ed40000" filename = "" Region: id = 1070 start_va = 0x23f3ed50000 end_va = 0x23f3f086fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1071 start_va = 0x23f3f090000 end_va = 0x23f3f210fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3f090000" filename = "" Region: id = 1072 start_va = 0x23f3f220000 end_va = 0x23f3f2dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3f220000" filename = "" Region: id = 1073 start_va = 0x23f3f2e0000 end_va = 0x23f3f3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023f3f2e0000" filename = "" Region: id = 1074 start_va = 0x23f3f3e0000 end_va = 0x23f3f4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023f3f3e0000" filename = "" Region: id = 1075 start_va = 0x7df5ff270000 end_va = 0x7ff5ff26ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff270000" filename = "" Region: id = 1076 start_va = 0x7ff70d240000 end_va = 0x7ff70d33ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff70d240000" filename = "" Region: id = 1077 start_va = 0x7ff70d340000 end_va = 0x7ff70d362fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff70d340000" filename = "" Region: id = 1078 start_va = 0x7ff70db70000 end_va = 0x7ff70dbeffff monitored = 0 entry_point = 0x7ff70db85f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1079 start_va = 0x7fffd48b0000 end_va = 0x7fffd4a7efff monitored = 1 entry_point = 0x7fffd48d7df0 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1080 start_va = 0x7fffd6f30000 end_va = 0x7fffd6f3afff monitored = 0 entry_point = 0x7fffd6f312b0 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 1081 start_va = 0x7fffdb3d0000 end_va = 0x7fffdb3e3fff monitored = 0 entry_point = 0x7fffdb3d1310 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 1082 start_va = 0x7fffdbca0000 end_va = 0x7fffdbcb5fff monitored = 0 entry_point = 0x7fffdbca55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1083 start_va = 0x7fffdbe20000 end_va = 0x7fffdbe44fff monitored = 0 entry_point = 0x7fffdbe29900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1084 start_va = 0x7fffdbe90000 end_va = 0x7fffdbf85fff monitored = 0 entry_point = 0x7fffdbec9590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1085 start_va = 0x7fffdc1c0000 end_va = 0x7fffdc1d0fff monitored = 0 entry_point = 0x7fffdc1c2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1086 start_va = 0x7fffdc3a0000 end_va = 0x7fffdc3adfff monitored = 0 entry_point = 0x7fffdc3a1da0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1087 start_va = 0x7fffdc430000 end_va = 0x7fffdc43bfff monitored = 0 entry_point = 0x7fffdc4335c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1088 start_va = 0x7fffdc440000 end_va = 0x7fffdc48dfff monitored = 0 entry_point = 0x7fffdc451ce0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1089 start_va = 0x7fffdf030000 end_va = 0x7fffdf0aefff monitored = 1 entry_point = 0x7fffdf047110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1090 start_va = 0x7fffe2560000 end_va = 0x7fffe2585fff monitored = 0 entry_point = 0x7fffe2561cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1091 start_va = 0x7fffe4f60000 end_va = 0x7fffe4f71fff monitored = 0 entry_point = 0x7fffe4f63580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1092 start_va = 0x7fffe63f0000 end_va = 0x7fffe6408fff monitored = 0 entry_point = 0x7fffe63f4520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1093 start_va = 0x7fffe6b80000 end_va = 0x7fffe6bbdfff monitored = 0 entry_point = 0x7fffe6b8a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1094 start_va = 0x7fffe6c80000 end_va = 0x7fffe6c95fff monitored = 0 entry_point = 0x7fffe6c81b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1095 start_va = 0x7fffe8ca0000 end_va = 0x7fffe8cb0fff monitored = 0 entry_point = 0x7fffe8ca3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1096 start_va = 0x7fffe9060000 end_va = 0x7fffe9069fff monitored = 0 entry_point = 0x7fffe9061660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1097 start_va = 0x7fffeb4e0000 end_va = 0x7fffeb4f3fff monitored = 0 entry_point = 0x7fffeb4e1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1098 start_va = 0x7fffeb500000 end_va = 0x7fffeb512fff monitored = 0 entry_point = 0x7fffeb502760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1099 start_va = 0x7fffeb7e0000 end_va = 0x7fffeb806fff monitored = 0 entry_point = 0x7fffeb7e7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1100 start_va = 0x7fffec1d0000 end_va = 0x7fffec1dbfff monitored = 0 entry_point = 0x7fffec1d27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1101 start_va = 0x7fffec310000 end_va = 0x7fffec389fff monitored = 0 entry_point = 0x7fffec331a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1102 start_va = 0x7fffec960000 end_va = 0x7fffec9b5fff monitored = 0 entry_point = 0x7fffec970bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1103 start_va = 0x7fffecaa0000 end_va = 0x7fffecaccfff monitored = 0 entry_point = 0x7fffecab9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1104 start_va = 0x7fffecc50000 end_va = 0x7fffecc78fff monitored = 0 entry_point = 0x7fffecc64530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1105 start_va = 0x7fffecde0000 end_va = 0x7fffece2afff monitored = 0 entry_point = 0x7fffecde35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1106 start_va = 0x7fffece30000 end_va = 0x7fffece3ffff monitored = 0 entry_point = 0x7fffece356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1107 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1108 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1109 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1110 start_va = 0x7fffed8d0000 end_va = 0x7fffed8e6fff monitored = 0 entry_point = 0x7fffed8d1390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1111 start_va = 0x7fffed8f0000 end_va = 0x7fffed932fff monitored = 0 entry_point = 0x7fffed904b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1112 start_va = 0x7fffed940000 end_va = 0x7fffedb06fff monitored = 0 entry_point = 0x7fffed99db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1113 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1114 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1115 start_va = 0x7fffede30000 end_va = 0x7fffeded6fff monitored = 0 entry_point = 0x7fffede3b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1116 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1117 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1118 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1119 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1120 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1121 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1122 start_va = 0x7ffff0540000 end_va = 0x7ffff05aafff monitored = 0 entry_point = 0x7ffff05590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1123 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1124 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1273 start_va = 0x23f3e990000 end_va = 0x23f3e991fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3e990000" filename = "" Region: id = 1274 start_va = 0x23f3f4e0000 end_va = 0x23f3f5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023f3f4e0000" filename = "" Region: id = 1275 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed10420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1276 start_va = 0x23f3ed30000 end_va = 0x23f3ed32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1277 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed10420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1278 start_va = 0x23f3ed30000 end_va = 0x23f3ed32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1279 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed10420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1280 start_va = 0x23f3ed30000 end_va = 0x23f3ed32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1281 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed10420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1282 start_va = 0x23f3ed30000 end_va = 0x23f3ed32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1283 start_va = 0x23f3ed00000 end_va = 0x23f3ed19fff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1284 start_va = 0x23f3ed30000 end_va = 0x23f3ed35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1285 start_va = 0x23f3ed00000 end_va = 0x23f3ed19fff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1286 start_va = 0x23f3ed30000 end_va = 0x23f3ed35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1287 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 1288 start_va = 0x23f3f5e0000 end_va = 0x23f3f69bfff monitored = 0 entry_point = 0x23f3f61c480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 1289 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 1290 start_va = 0x23f3f5e0000 end_va = 0x23f3f69bfff monitored = 0 entry_point = 0x23f3f61c480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 1291 start_va = 0x23f3ed00000 end_va = 0x23f3ed04fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1292 start_va = 0x23f3f5e0000 end_va = 0x23f3f60afff monitored = 0 entry_point = 0x23f3f5fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1293 start_va = 0x23f3ed00000 end_va = 0x23f3ed04fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1294 start_va = 0x23f3f5e0000 end_va = 0x23f3f60afff monitored = 0 entry_point = 0x23f3f5fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1295 start_va = 0x23f3ed00000 end_va = 0x23f3ed04fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1296 start_va = 0x23f3f5e0000 end_va = 0x23f3f60afff monitored = 0 entry_point = 0x23f3f5fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1297 start_va = 0x23f3ed00000 end_va = 0x23f3ed04fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1298 start_va = 0x23f3f5e0000 end_va = 0x23f3f60afff monitored = 0 entry_point = 0x23f3f5fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1299 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1300 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1301 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1302 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1303 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1304 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1305 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1306 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1307 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1308 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1309 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1310 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1311 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1312 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1313 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1314 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1315 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1316 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1317 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1318 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1319 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1320 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1321 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1322 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1323 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1324 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1325 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1326 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1327 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1328 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1329 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1330 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1331 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1332 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1333 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1334 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1335 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1336 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1337 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1338 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1339 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1340 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1341 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1342 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1343 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1344 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1345 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1346 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1347 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 1348 start_va = 0x23f3f5e0000 end_va = 0x23f3f639fff monitored = 0 entry_point = 0x23f3f625b00 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 1349 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 1350 start_va = 0x23f3f5e0000 end_va = 0x23f3f639fff monitored = 0 entry_point = 0x23f3f625b00 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 1351 start_va = 0x23f3ed00000 end_va = 0x23f3ed00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 1352 start_va = 0x23f3f5e0000 end_va = 0x23f3f6c1fff monitored = 0 entry_point = 0x23f3f63d100 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 1353 start_va = 0x23f3ed00000 end_va = 0x23f3ed00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 1354 start_va = 0x23f3f5e0000 end_va = 0x23f3f6c1fff monitored = 0 entry_point = 0x23f3f63d100 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 1355 start_va = 0x23f3f5e0000 end_va = 0x23f3f6c3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1356 start_va = 0x23f3f6d0000 end_va = 0x23f3f6f8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1357 start_va = 0x23f3f5e0000 end_va = 0x23f3f6c3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1358 start_va = 0x23f3f6d0000 end_va = 0x23f3f6f8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1359 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1360 start_va = 0x23f3f5e0000 end_va = 0x23f3f672fff monitored = 0 entry_point = 0x23f3f659000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1361 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1362 start_va = 0x23f3f5e0000 end_va = 0x23f3f672fff monitored = 0 entry_point = 0x23f3f659000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1363 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1364 start_va = 0x23f3f5e0000 end_va = 0x23f3f680fff monitored = 0 entry_point = 0x23f3f673000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1365 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1366 start_va = 0x23f3f5e0000 end_va = 0x23f3f680fff monitored = 0 entry_point = 0x23f3f673000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1367 start_va = 0x23f3ed00000 end_va = 0x23f3ed0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1368 start_va = 0x23f3f5e0000 end_va = 0x23f3f665fff monitored = 0 entry_point = 0x23f3f651000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1369 start_va = 0x23f3ed00000 end_va = 0x23f3ed0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1370 start_va = 0x23f3f5e0000 end_va = 0x23f3f665fff monitored = 0 entry_point = 0x23f3f651000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1371 start_va = 0x23f3ed00000 end_va = 0x23f3ed0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1372 start_va = 0x23f3f5e0000 end_va = 0x23f3f665fff monitored = 0 entry_point = 0x23f3f651000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1373 start_va = 0x23f3ed00000 end_va = 0x23f3ed0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1374 start_va = 0x23f3f5e0000 end_va = 0x23f3f665fff monitored = 0 entry_point = 0x23f3f651000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1375 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 1376 start_va = 0x23f3f5e0000 end_va = 0x23f3f697fff monitored = 0 entry_point = 0x23f3f5e1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 1377 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 1378 start_va = 0x23f3f5e0000 end_va = 0x23f3f697fff monitored = 0 entry_point = 0x23f3f5e1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 1379 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 1380 start_va = 0x23f3f5e0000 end_va = 0x23f3f697fff monitored = 0 entry_point = 0x23f3f5e1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 1381 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 1382 start_va = 0x23f3f5e0000 end_va = 0x23f3f697fff monitored = 0 entry_point = 0x23f3f5e1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 1383 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1384 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1385 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1386 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1387 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1388 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1389 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1390 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1391 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1392 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1393 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1394 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1395 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1396 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1397 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1398 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1399 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1400 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1401 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1402 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1403 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1404 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1405 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1406 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1407 start_va = 0x23f3ed00000 end_va = 0x23f3ed0efff monitored = 0 entry_point = 0x23f3ed036e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 1408 start_va = 0x23f3ed10000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 1409 start_va = 0x23f3ed00000 end_va = 0x23f3ed0efff monitored = 0 entry_point = 0x23f3ed036e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 1410 start_va = 0x23f3ed10000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 1411 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1412 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1413 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1414 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1415 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1416 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1417 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1418 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1419 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1420 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1421 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1422 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1423 start_va = 0x23f3ed00000 end_va = 0x23f3ed01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1424 start_va = 0x23f3f5e0000 end_va = 0x23f3f6eefff monitored = 0 entry_point = 0x23f3f61c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1425 start_va = 0x23f3ed00000 end_va = 0x23f3ed01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1426 start_va = 0x23f3f5e0000 end_va = 0x23f3f6eefff monitored = 0 entry_point = 0x23f3f61c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1427 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed03630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 1428 start_va = 0x23f3ed30000 end_va = 0x23f3ed31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 1429 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed03630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 1430 start_va = 0x23f3ed30000 end_va = 0x23f3ed31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 1431 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed03630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 1432 start_va = 0x23f3ed30000 end_va = 0x23f3ed31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 1433 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed03630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 1434 start_va = 0x23f3ed30000 end_va = 0x23f3ed31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 1435 start_va = 0x23f3ed00000 end_va = 0x23f3ed16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1436 start_va = 0x23f3f5e0000 end_va = 0x23f3f836fff monitored = 0 entry_point = 0x23f3f7ece10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1437 start_va = 0x23f3ed00000 end_va = 0x23f3ed16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1438 start_va = 0x23f3f5e0000 end_va = 0x23f3f836fff monitored = 0 entry_point = 0x23f3f7ece10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1439 start_va = 0x23f3ed00000 end_va = 0x23f3ed09fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1440 start_va = 0x23f3f5e0000 end_va = 0x23f3f6f0fff monitored = 0 entry_point = 0x23f3f6d1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1441 start_va = 0x23f3ed00000 end_va = 0x23f3ed09fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1442 start_va = 0x23f3f5e0000 end_va = 0x23f3f6f0fff monitored = 0 entry_point = 0x23f3f6d1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1443 start_va = 0x23f3ed00000 end_va = 0x23f3ed09fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1444 start_va = 0x23f3f5e0000 end_va = 0x23f3f6f0fff monitored = 0 entry_point = 0x23f3f6d1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1445 start_va = 0x23f3ed00000 end_va = 0x23f3ed09fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1446 start_va = 0x23f3f5e0000 end_va = 0x23f3f6f0fff monitored = 0 entry_point = 0x23f3f6d1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1447 start_va = 0x23f3ed00000 end_va = 0x23f3ed09fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1448 start_va = 0x23f3f5e0000 end_va = 0x23f3f6f0fff monitored = 0 entry_point = 0x23f3f6d1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1449 start_va = 0x23f3ed00000 end_va = 0x23f3ed09fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1450 start_va = 0x23f3f5e0000 end_va = 0x23f3f6f0fff monitored = 0 entry_point = 0x23f3f6d1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1451 start_va = 0x23f3ed00000 end_va = 0x23f3ed0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1452 start_va = 0x23f3ed10000 end_va = 0x23f3ed1dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1453 start_va = 0x23f3ed00000 end_va = 0x23f3ed0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1454 start_va = 0x23f3ed10000 end_va = 0x23f3ed1dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1455 start_va = 0x23f3ed00000 end_va = 0x23f3ed06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 1456 start_va = 0x23f3f5e0000 end_va = 0x23f3f9e7fff monitored = 0 entry_point = 0x23f3f6ae3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 1457 start_va = 0x23f3ed00000 end_va = 0x23f3ed06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 1458 start_va = 0x23f3f5e0000 end_va = 0x23f3f9e7fff monitored = 0 entry_point = 0x23f3f6ae3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 1459 start_va = 0x23f3ed00000 end_va = 0x23f3ed06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 1460 start_va = 0x23f3f5e0000 end_va = 0x23f3f9e7fff monitored = 0 entry_point = 0x23f3f6ae3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 1461 start_va = 0x23f3ed00000 end_va = 0x23f3ed06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 1462 start_va = 0x23f3f5e0000 end_va = 0x23f3f9e7fff monitored = 0 entry_point = 0x23f3f6ae3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 1463 start_va = 0x23f3ed00000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1464 start_va = 0x23f3f5e0000 end_va = 0x23f3f68efff monitored = 0 entry_point = 0x23f3f657000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1465 start_va = 0x23f3ed00000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1466 start_va = 0x23f3f5e0000 end_va = 0x23f3f68efff monitored = 0 entry_point = 0x23f3f657000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1467 start_va = 0x23f3ed00000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1468 start_va = 0x23f3f5e0000 end_va = 0x23f3f68efff monitored = 0 entry_point = 0x23f3f657000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1469 start_va = 0x23f3ed00000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1470 start_va = 0x23f3f5e0000 end_va = 0x23f3f68efff monitored = 0 entry_point = 0x23f3f657000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1471 start_va = 0x23f3ed00000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1472 start_va = 0x23f3f5e0000 end_va = 0x23f3f68efff monitored = 0 entry_point = 0x23f3f657000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1473 start_va = 0x23f3ed00000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1474 start_va = 0x23f3f5e0000 end_va = 0x23f3f68efff monitored = 0 entry_point = 0x23f3f657000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1475 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 1476 start_va = 0x23f3f5e0000 end_va = 0x23f3f6b4fff monitored = 0 entry_point = 0x23f3f60e0b0 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 1477 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 1478 start_va = 0x23f3f5e0000 end_va = 0x23f3f6b4fff monitored = 0 entry_point = 0x23f3f60e0b0 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 1479 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1480 start_va = 0x23f3f5e0000 end_va = 0x23f3f640fff monitored = 0 entry_point = 0x23f3f5f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1481 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1482 start_va = 0x23f3f5e0000 end_va = 0x23f3f640fff monitored = 0 entry_point = 0x23f3f5f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1483 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1484 start_va = 0x23f3f5e0000 end_va = 0x23f3f640fff monitored = 0 entry_point = 0x23f3f5f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1485 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1486 start_va = 0x23f3f5e0000 end_va = 0x23f3f640fff monitored = 0 entry_point = 0x23f3f5f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1487 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1488 start_va = 0x23f3f5e0000 end_va = 0x23f3f640fff monitored = 0 entry_point = 0x23f3f5f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1489 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1490 start_va = 0x23f3f5e0000 end_va = 0x23f3f640fff monitored = 0 entry_point = 0x23f3f5f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1491 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 1492 start_va = 0x23f3f5e0000 end_va = 0x23f3f627fff monitored = 0 entry_point = 0x23f3f61acf0 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 1493 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 1494 start_va = 0x23f3f5e0000 end_va = 0x23f3f627fff monitored = 0 entry_point = 0x23f3f61acf0 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 1495 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1496 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1497 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1498 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1499 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1500 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1501 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1502 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1503 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1504 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1505 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1506 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1507 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1508 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1509 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1510 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1511 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1512 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1513 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1514 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1515 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1516 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1517 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1518 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1519 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1520 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1521 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1522 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1523 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1524 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1525 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1526 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1527 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1528 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1529 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1530 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1531 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1532 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1533 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1534 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1535 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1536 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1537 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1538 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1539 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1540 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1541 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1542 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1543 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1544 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1545 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1546 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1547 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1548 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1549 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1550 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1551 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1552 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1553 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1554 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1555 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1556 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1557 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1558 start_va = 0x23f3f5e0000 end_va = 0x23f3f5f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1559 start_va = 0x23f3ed00000 end_va = 0x23f3ed0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1560 start_va = 0x23f3f5e0000 end_va = 0x23f3f651fff monitored = 0 entry_point = 0x23f3f637000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1561 start_va = 0x23f3ed00000 end_va = 0x23f3ed0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1562 start_va = 0x23f3f5e0000 end_va = 0x23f3f651fff monitored = 0 entry_point = 0x23f3f637000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1563 start_va = 0x23f3ed00000 end_va = 0x23f3ed18fff monitored = 0 entry_point = 0x23f3ed0b610 region_type = mapped_file name = "eqossnap.dll" filename = "\\Windows\\System32\\eqossnap.dll" (normalized: "c:\\windows\\system32\\eqossnap.dll") Region: id = 1564 start_va = 0x23f3ed30000 end_va = 0x23f3ed35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eqossnap.dll.mui" filename = "\\Windows\\System32\\en-US\\eqossnap.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\eqossnap.dll.mui") Region: id = 1565 start_va = 0x23f3ed00000 end_va = 0x23f3ed18fff monitored = 0 entry_point = 0x23f3ed0b610 region_type = mapped_file name = "eqossnap.dll" filename = "\\Windows\\System32\\eqossnap.dll" (normalized: "c:\\windows\\system32\\eqossnap.dll") Region: id = 1566 start_va = 0x23f3ed30000 end_va = 0x23f3ed35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eqossnap.dll.mui" filename = "\\Windows\\System32\\en-US\\eqossnap.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\eqossnap.dll.mui") Region: id = 1567 start_va = 0x23f3ed00000 end_va = 0x23f3ed07fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 1568 start_va = 0x23f3f5e0000 end_va = 0x23f3f7c8fff monitored = 0 entry_point = 0x23f3f5e15f0 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 1569 start_va = 0x23f3ed00000 end_va = 0x23f3ed07fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 1570 start_va = 0x23f3f5e0000 end_va = 0x23f3f7c8fff monitored = 0 entry_point = 0x23f3f5e15f0 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 1571 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 1572 start_va = 0x23f3f5e0000 end_va = 0x23f3f639fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 1573 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 1574 start_va = 0x23f3f5e0000 end_va = 0x23f3f639fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 1575 start_va = 0x23f3ed00000 end_va = 0x23f3ed01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 1576 start_va = 0x23f3f5e0000 end_va = 0x23f3f6bffff monitored = 0 entry_point = 0x23f3f672eb0 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 1577 start_va = 0x23f3ed00000 end_va = 0x23f3ed01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 1578 start_va = 0x23f3f5e0000 end_va = 0x23f3f6bffff monitored = 0 entry_point = 0x23f3f672eb0 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 1579 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed10420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1580 start_va = 0x23f3ed30000 end_va = 0x23f3ed32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1581 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed10420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1582 start_va = 0x23f3ed30000 end_va = 0x23f3ed32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1583 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed10420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1584 start_va = 0x23f3ed30000 end_va = 0x23f3ed32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1585 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed10420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 1586 start_va = 0x23f3ed30000 end_va = 0x23f3ed32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 1587 start_va = 0x23f3ed00000 end_va = 0x23f3ed19fff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1588 start_va = 0x23f3ed30000 end_va = 0x23f3ed35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1589 start_va = 0x23f3ed00000 end_va = 0x23f3ed19fff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 1590 start_va = 0x23f3ed30000 end_va = 0x23f3ed35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 1591 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 1592 start_va = 0x23f3f5e0000 end_va = 0x23f3f69bfff monitored = 0 entry_point = 0x23f3f61c480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 1593 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 1594 start_va = 0x23f3f5e0000 end_va = 0x23f3f69bfff monitored = 0 entry_point = 0x23f3f61c480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 1595 start_va = 0x23f3ed00000 end_va = 0x23f3ed04fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1596 start_va = 0x23f3f5e0000 end_va = 0x23f3f60afff monitored = 0 entry_point = 0x23f3f5fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1597 start_va = 0x23f3ed00000 end_va = 0x23f3ed04fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1598 start_va = 0x23f3f5e0000 end_va = 0x23f3f60afff monitored = 0 entry_point = 0x23f3f5fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1599 start_va = 0x23f3ed00000 end_va = 0x23f3ed04fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1600 start_va = 0x23f3f5e0000 end_va = 0x23f3f60afff monitored = 0 entry_point = 0x23f3f5fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1601 start_va = 0x23f3ed00000 end_va = 0x23f3ed04fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 1602 start_va = 0x23f3f5e0000 end_va = 0x23f3f60afff monitored = 0 entry_point = 0x23f3f5fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 1603 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1604 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1605 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1606 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1607 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1608 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1609 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1610 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1611 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1612 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1613 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1614 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1615 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1616 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1617 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1618 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1619 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1620 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1621 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1622 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1623 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1624 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1625 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1626 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1627 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1628 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1629 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1630 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1631 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1632 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1633 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1634 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1635 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1636 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1637 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1638 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1639 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1640 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1641 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1642 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1643 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1644 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1645 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1646 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1647 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1648 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1649 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1650 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1651 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1652 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1653 start_va = 0x23f3ed00000 end_va = 0x23f3ed1cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 1654 start_va = 0x23f3f5e0000 end_va = 0x23f3f646fff monitored = 0 entry_point = 0x23f3f5e63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1655 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 1656 start_va = 0x23f3f5e0000 end_va = 0x23f3f639fff monitored = 0 entry_point = 0x23f3f625b00 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 1657 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 1658 start_va = 0x23f3f5e0000 end_va = 0x23f3f639fff monitored = 0 entry_point = 0x23f3f625b00 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 1659 start_va = 0x23f3ed00000 end_va = 0x23f3ed00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 1660 start_va = 0x23f3f5e0000 end_va = 0x23f3f6c1fff monitored = 0 entry_point = 0x23f3f63d100 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 1661 start_va = 0x23f3ed00000 end_va = 0x23f3ed00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 1662 start_va = 0x23f3f5e0000 end_va = 0x23f3f6c1fff monitored = 0 entry_point = 0x23f3f63d100 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 1663 start_va = 0x23f3f5e0000 end_va = 0x23f3f6c3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1664 start_va = 0x23f3f6d0000 end_va = 0x23f3f6f8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1665 start_va = 0x23f3f5e0000 end_va = 0x23f3f6c3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 1666 start_va = 0x23f3f6d0000 end_va = 0x23f3f6f8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 1667 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1668 start_va = 0x23f3f5e0000 end_va = 0x23f3f672fff monitored = 0 entry_point = 0x23f3f659000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1669 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 1670 start_va = 0x23f3f5e0000 end_va = 0x23f3f672fff monitored = 0 entry_point = 0x23f3f659000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 1671 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1672 start_va = 0x23f3f5e0000 end_va = 0x23f3f680fff monitored = 0 entry_point = 0x23f3f673000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1673 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 1674 start_va = 0x23f3f5e0000 end_va = 0x23f3f680fff monitored = 0 entry_point = 0x23f3f673000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 1675 start_va = 0x23f3ed00000 end_va = 0x23f3ed0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1676 start_va = 0x23f3f5e0000 end_va = 0x23f3f665fff monitored = 0 entry_point = 0x23f3f651000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1677 start_va = 0x23f3ed00000 end_va = 0x23f3ed0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1678 start_va = 0x23f3f5e0000 end_va = 0x23f3f665fff monitored = 0 entry_point = 0x23f3f651000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1679 start_va = 0x23f3ed00000 end_va = 0x23f3ed0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1680 start_va = 0x23f3f5e0000 end_va = 0x23f3f665fff monitored = 0 entry_point = 0x23f3f651000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1681 start_va = 0x23f3ed00000 end_va = 0x23f3ed0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 1682 start_va = 0x23f3f5e0000 end_va = 0x23f3f665fff monitored = 0 entry_point = 0x23f3f651000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 1683 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 1684 start_va = 0x23f3f5e0000 end_va = 0x23f3f697fff monitored = 0 entry_point = 0x23f3f5e1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 1685 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 1686 start_va = 0x23f3f5e0000 end_va = 0x23f3f697fff monitored = 0 entry_point = 0x23f3f5e1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 1687 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 1688 start_va = 0x23f3f5e0000 end_va = 0x23f3f697fff monitored = 0 entry_point = 0x23f3f5e1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 1689 start_va = 0x23f3ed00000 end_va = 0x23f3ed05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 1690 start_va = 0x23f3f5e0000 end_va = 0x23f3f697fff monitored = 0 entry_point = 0x23f3f5e1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 1691 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1692 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1693 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1694 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1695 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1696 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1697 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1698 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1699 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1700 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1701 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1702 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1703 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1704 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1705 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1706 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1707 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1708 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1709 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1710 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1711 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1712 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1713 start_va = 0x23f3ed00000 end_va = 0x23f3ed0cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1714 start_va = 0x23f3f5e0000 end_va = 0x23f3f6d2fff monitored = 0 entry_point = 0x23f3f605d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1715 start_va = 0x23f3ed00000 end_va = 0x23f3ed0efff monitored = 0 entry_point = 0x23f3ed036e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 1716 start_va = 0x23f3ed10000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 1717 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1718 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1719 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1720 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1721 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1722 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1723 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1724 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1725 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1726 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1727 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1728 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1729 start_va = 0x23f3ed00000 end_va = 0x23f3ed1afff monitored = 1 entry_point = 0x23f3ed01190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 1730 start_va = 0x23f3ed30000 end_va = 0x23f3ed3bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 1731 start_va = 0x23f3ed00000 end_va = 0x23f3ed01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1732 start_va = 0x23f3f5e0000 end_va = 0x23f3f6eefff monitored = 0 entry_point = 0x23f3f61c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1733 start_va = 0x23f3ed00000 end_va = 0x23f3ed01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1734 start_va = 0x23f3f5e0000 end_va = 0x23f3f6eefff monitored = 0 entry_point = 0x23f3f61c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1735 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed03630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 1736 start_va = 0x23f3ed30000 end_va = 0x23f3ed31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 1737 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed03630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 1738 start_va = 0x23f3ed30000 end_va = 0x23f3ed31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 1739 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed03630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 1740 start_va = 0x23f3ed30000 end_va = 0x23f3ed31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 1741 start_va = 0x23f3ed00000 end_va = 0x23f3ed15fff monitored = 0 entry_point = 0x23f3ed03630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 1742 start_va = 0x23f3ed30000 end_va = 0x23f3ed31fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 1743 start_va = 0x23f3ed00000 end_va = 0x23f3ed16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1744 start_va = 0x23f3f5e0000 end_va = 0x23f3f836fff monitored = 0 entry_point = 0x23f3f7ece10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1745 start_va = 0x23f3ed00000 end_va = 0x23f3ed16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 1746 start_va = 0x23f3f5e0000 end_va = 0x23f3f836fff monitored = 0 entry_point = 0x23f3f7ece10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 1747 start_va = 0x23f3ed00000 end_va = 0x23f3ed09fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1748 start_va = 0x23f3f5e0000 end_va = 0x23f3f6f0fff monitored = 0 entry_point = 0x23f3f6d1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1749 start_va = 0x23f3ed00000 end_va = 0x23f3ed09fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1750 start_va = 0x23f3f5e0000 end_va = 0x23f3f6f0fff monitored = 0 entry_point = 0x23f3f6d1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1751 start_va = 0x23f3ed00000 end_va = 0x23f3ed09fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1752 start_va = 0x23f3f5e0000 end_va = 0x23f3f6f0fff monitored = 0 entry_point = 0x23f3f6d1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1753 start_va = 0x23f3ed00000 end_va = 0x23f3ed09fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1754 start_va = 0x23f3f5e0000 end_va = 0x23f3f6f0fff monitored = 0 entry_point = 0x23f3f6d1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1755 start_va = 0x23f3ed00000 end_va = 0x23f3ed09fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1756 start_va = 0x23f3f5e0000 end_va = 0x23f3f6f0fff monitored = 0 entry_point = 0x23f3f6d1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1757 start_va = 0x23f3ed00000 end_va = 0x23f3ed09fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 1758 start_va = 0x23f3f5e0000 end_va = 0x23f3f6f0fff monitored = 0 entry_point = 0x23f3f6d1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 1759 start_va = 0x23f3ed00000 end_va = 0x23f3ed0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1760 start_va = 0x23f3ed10000 end_va = 0x23f3ed1dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1761 start_va = 0x23f3ed00000 end_va = 0x23f3ed0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1762 start_va = 0x23f3ed10000 end_va = 0x23f3ed1dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1763 start_va = 0x23f3ed00000 end_va = 0x23f3ed0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 1764 start_va = 0x23f3ed10000 end_va = 0x23f3ed1dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 1765 start_va = 0x23f3ed00000 end_va = 0x23f3ed06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 1766 start_va = 0x23f3f5e0000 end_va = 0x23f3f9e7fff monitored = 0 entry_point = 0x23f3f6ae3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 1767 start_va = 0x23f3ed00000 end_va = 0x23f3ed06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 1768 start_va = 0x23f3f5e0000 end_va = 0x23f3f9e7fff monitored = 0 entry_point = 0x23f3f6ae3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 1769 start_va = 0x23f3ed00000 end_va = 0x23f3ed06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 1770 start_va = 0x23f3f5e0000 end_va = 0x23f3f9e7fff monitored = 0 entry_point = 0x23f3f6ae3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 1771 start_va = 0x23f3ed00000 end_va = 0x23f3ed06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 1772 start_va = 0x23f3f5e0000 end_va = 0x23f3f9e7fff monitored = 0 entry_point = 0x23f3f6ae3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 1773 start_va = 0x23f3ed00000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1774 start_va = 0x23f3f5e0000 end_va = 0x23f3f68efff monitored = 0 entry_point = 0x23f3f657000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1775 start_va = 0x23f3ed00000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1776 start_va = 0x23f3f5e0000 end_va = 0x23f3f68efff monitored = 0 entry_point = 0x23f3f657000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1777 start_va = 0x23f3ed00000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1778 start_va = 0x23f3f5e0000 end_va = 0x23f3f68efff monitored = 0 entry_point = 0x23f3f657000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1779 start_va = 0x23f3ed00000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1780 start_va = 0x23f3f5e0000 end_va = 0x23f3f68efff monitored = 0 entry_point = 0x23f3f657000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1781 start_va = 0x23f3ed00000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1782 start_va = 0x23f3f5e0000 end_va = 0x23f3f68efff monitored = 0 entry_point = 0x23f3f657000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1783 start_va = 0x23f3ed00000 end_va = 0x23f3ed11fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 1784 start_va = 0x23f3f5e0000 end_va = 0x23f3f68efff monitored = 0 entry_point = 0x23f3f657000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 1785 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 1786 start_va = 0x23f3f5e0000 end_va = 0x23f3f6b4fff monitored = 0 entry_point = 0x23f3f60e0b0 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 1787 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 1788 start_va = 0x23f3f5e0000 end_va = 0x23f3f6b4fff monitored = 0 entry_point = 0x23f3f60e0b0 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 1789 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1790 start_va = 0x23f3f5e0000 end_va = 0x23f3f640fff monitored = 0 entry_point = 0x23f3f5f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1791 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1792 start_va = 0x23f3f5e0000 end_va = 0x23f3f640fff monitored = 0 entry_point = 0x23f3f5f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1793 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1794 start_va = 0x23f3f5e0000 end_va = 0x23f3f640fff monitored = 0 entry_point = 0x23f3f5f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1795 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1796 start_va = 0x23f3f5e0000 end_va = 0x23f3f640fff monitored = 0 entry_point = 0x23f3f5f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1797 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1798 start_va = 0x23f3f5e0000 end_va = 0x23f3f640fff monitored = 0 entry_point = 0x23f3f5f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1799 start_va = 0x23f3ed00000 end_va = 0x23f3ed03fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 1800 start_va = 0x23f3f5e0000 end_va = 0x23f3f640fff monitored = 0 entry_point = 0x23f3f5f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 1801 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 1802 start_va = 0x23f3f5e0000 end_va = 0x23f3f627fff monitored = 0 entry_point = 0x23f3f61acf0 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 1803 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 1804 start_va = 0x23f3f5e0000 end_va = 0x23f3f627fff monitored = 0 entry_point = 0x23f3f61acf0 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 1805 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1806 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1807 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1808 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1809 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1810 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1811 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1812 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1813 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1814 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1815 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1816 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1817 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1818 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1819 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1820 start_va = 0x23f3f5e0000 end_va = 0x23f3f6fffff monitored = 0 entry_point = 0x23f3f6dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1821 start_va = 0x23f3f5e0000 end_va = 0x23f3f7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023f3f5e0000" filename = "" Region: id = 1822 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1823 start_va = 0x23f3f7e0000 end_va = 0x23f3f8fffff monitored = 0 entry_point = 0x23f3f8dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1824 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1825 start_va = 0x23f3f7e0000 end_va = 0x23f3f8fffff monitored = 0 entry_point = 0x23f3f8dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1826 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1827 start_va = 0x23f3f7e0000 end_va = 0x23f3f8fffff monitored = 0 entry_point = 0x23f3f8dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1828 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1829 start_va = 0x23f3f7e0000 end_va = 0x23f3f8fffff monitored = 0 entry_point = 0x23f3f8dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1830 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1831 start_va = 0x23f3f7e0000 end_va = 0x23f3f8fffff monitored = 0 entry_point = 0x23f3f8dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1832 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1833 start_va = 0x23f3f7e0000 end_va = 0x23f3f8fffff monitored = 0 entry_point = 0x23f3f8dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1834 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1835 start_va = 0x23f3f7e0000 end_va = 0x23f3f8fffff monitored = 0 entry_point = 0x23f3f8dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1836 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1837 start_va = 0x23f3f7e0000 end_va = 0x23f3f8fffff monitored = 0 entry_point = 0x23f3f8dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1838 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1839 start_va = 0x23f3f7e0000 end_va = 0x23f3f8fffff monitored = 0 entry_point = 0x23f3f8dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1840 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 1841 start_va = 0x23f3f7e0000 end_va = 0x23f3f8fffff monitored = 0 entry_point = 0x23f3f8dc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 1842 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1843 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1844 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1845 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1846 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1847 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1848 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1849 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1850 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1851 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1852 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1853 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1854 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1855 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1856 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1857 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1858 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1859 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1860 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1861 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1862 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1863 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1864 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1865 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1866 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1867 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1868 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1869 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1870 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 1871 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 1872 start_va = 0x23f3ed00000 end_va = 0x23f3ed0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1873 start_va = 0x23f3f7e0000 end_va = 0x23f3f851fff monitored = 0 entry_point = 0x23f3f837000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1874 start_va = 0x23f3ed00000 end_va = 0x23f3ed0ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 1875 start_va = 0x23f3f7e0000 end_va = 0x23f3f851fff monitored = 0 entry_point = 0x23f3f837000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 1876 start_va = 0x23f3ed00000 end_va = 0x23f3ed18fff monitored = 0 entry_point = 0x23f3ed0b610 region_type = mapped_file name = "eqossnap.dll" filename = "\\Windows\\System32\\eqossnap.dll" (normalized: "c:\\windows\\system32\\eqossnap.dll") Region: id = 1877 start_va = 0x23f3ed30000 end_va = 0x23f3ed35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eqossnap.dll.mui" filename = "\\Windows\\System32\\en-US\\eqossnap.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\eqossnap.dll.mui") Region: id = 1878 start_va = 0x23f3ed00000 end_va = 0x23f3ed18fff monitored = 0 entry_point = 0x23f3ed0b610 region_type = mapped_file name = "eqossnap.dll" filename = "\\Windows\\System32\\eqossnap.dll" (normalized: "c:\\windows\\system32\\eqossnap.dll") Region: id = 1879 start_va = 0x23f3ed30000 end_va = 0x23f3ed35fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eqossnap.dll.mui" filename = "\\Windows\\System32\\en-US\\eqossnap.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\eqossnap.dll.mui") Region: id = 1880 start_va = 0x23f3ed00000 end_va = 0x23f3ed07fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 1881 start_va = 0x23f3f7e0000 end_va = 0x23f3f9c8fff monitored = 0 entry_point = 0x23f3f7e15f0 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 1882 start_va = 0x23f3ed00000 end_va = 0x23f3ed07fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 1883 start_va = 0x23f3f7e0000 end_va = 0x23f3f9c8fff monitored = 0 entry_point = 0x23f3f7e15f0 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 1884 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 1885 start_va = 0x23f3f7e0000 end_va = 0x23f3f839fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 1886 start_va = 0x23f3ed00000 end_va = 0x23f3ed10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 1887 start_va = 0x23f3f7e0000 end_va = 0x23f3f839fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 1888 start_va = 0x23f3ed00000 end_va = 0x23f3ed01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 1889 start_va = 0x23f3f7e0000 end_va = 0x23f3f8bffff monitored = 0 entry_point = 0x23f3f872eb0 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 1890 start_va = 0x23f3ed00000 end_va = 0x23f3ed01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 1891 start_va = 0x23f3f7e0000 end_va = 0x23f3f8bffff monitored = 0 entry_point = 0x23f3f872eb0 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 1892 start_va = 0x7fffeb640000 end_va = 0x7fffeb64dfff monitored = 0 entry_point = 0x7fffeb642b10 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 1902 start_va = 0x23f3ed00000 end_va = 0x23f3ed02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3ed00000" filename = "" Region: id = 1903 start_va = 0x7fffe5d70000 end_va = 0x7fffe5da7fff monitored = 0 entry_point = 0x7fffe5d88cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1904 start_va = 0x7ffff0530000 end_va = 0x7ffff0537fff monitored = 0 entry_point = 0x7ffff0531ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1905 start_va = 0x9dd0400000 end_va = 0x9dd047ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000009dd0400000" filename = "" Region: id = 1906 start_va = 0x7fffe5bd0000 end_va = 0x7fffe5be5fff monitored = 0 entry_point = 0x7fffe5bd19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1907 start_va = 0x7fffe5bb0000 end_va = 0x7fffe5bc9fff monitored = 0 entry_point = 0x7fffe5bb2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1909 start_va = 0x23f3f7e0000 end_va = 0x23f3f7f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3f7e0000" filename = "" Region: id = 1910 start_va = 0x7fffeb830000 end_va = 0x7fffeb8d9fff monitored = 0 entry_point = 0x7fffeb857910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2010 start_va = 0x23f3ed10000 end_va = 0x23f3ed13fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023f3ed10000" filename = "" Thread: id = 111 os_tid = 0x11f8 [0342.261] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x9dd03ff810 | out: lpSystemTimeAsFileTime=0x9dd03ff810*(dwLowDateTime=0x5d87c6fd, dwHighDateTime=0x1da58e6)) [0342.263] free (_Block=0x23f3f2fe340) [0342.263] FreeLibrary (hLibModule=0x23f3e980000) returned 1 [0342.273] free (_Block=0x23f3f3031b0) [0342.274] free (_Block=0x23f3f2fcd50) [0342.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x9dd03ff810 | out: lpSystemTimeAsFileTime=0x9dd03ff810*(dwLowDateTime=0x5d89c2fc, dwHighDateTime=0x1da58e6)) [0342.275] free (_Block=0x23f3f301c20) [0342.275] FreeLibrary (hLibModule=0x23f3ecf0000) returned 1 [0342.278] free (_Block=0x23f3f305ff0) [0342.278] free (_Block=0x23f3f305910) [0342.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x9dd03ff810 | out: lpSystemTimeAsFileTime=0x9dd03ff810*(dwLowDateTime=0x5d8a722c, dwHighDateTime=0x1da58e6)) [0342.280] free (_Block=0x23f3f301f20) [0342.280] FreeLibrary (hLibModule=0x7ffff07a0000) returned 1 [0342.280] free (_Block=0x23f3f3070a0) [0342.280] free (_Block=0x23f3f305410) [0342.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x9dd03ff810 | out: lpSystemTimeAsFileTime=0x9dd03ff810*(dwLowDateTime=0x5d8a722c, dwHighDateTime=0x1da58e6)) [0342.280] free (_Block=0x23f3f301bc0) [0342.280] FreeLibrary (hLibModule=0x7fffefeb0000) returned 1 [0342.280] free (_Block=0x23f3f306890) [0342.281] free (_Block=0x23f3f306220) [0342.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x9dd03ff810 | out: lpSystemTimeAsFileTime=0x9dd03ff810*(dwLowDateTime=0x5d8a722c, dwHighDateTime=0x1da58e6)) [0342.281] free (_Block=0x23f3f301a60) [0342.281] FreeLibrary (hLibModule=0x7fffed8d0000) returned 1 [0342.296] free (_Block=0x23f3f304e70) [0342.296] free (_Block=0x23f3f3059b0) [0342.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x9dd03ff810 | out: lpSystemTimeAsFileTime=0x9dd03ff810*(dwLowDateTime=0x5d8ca12b, dwHighDateTime=0x1da58e6)) [0342.296] free (_Block=0x23f3f301d20) [0342.296] FreeLibrary (hLibModule=0x7fffed8f0000) returned 1 [0342.297] free (_Block=0x23f3f3067b0) [0342.297] free (_Block=0x23f3f3053c0) [0342.297] WaitForSingleObjectEx (hHandle=0x24c, dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 112 os_tid = 0x11f4 Thread: id = 113 os_tid = 0x11f0 Thread: id = 114 os_tid = 0x11ec [0161.475] DllCanUnloadNow () returned 0x1 [0281.504] DllCanUnloadNow () returned 0x1 Thread: id = 115 os_tid = 0x11e4 Thread: id = 116 os_tid = 0x11e0 Thread: id = 117 os_tid = 0x11dc [0153.122] RtlRestoreLastWin32Error () returned 0x9dcfeb4000 [0153.122] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x9dd00fdaa0 | out: pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x9dd00fdaa0) returned 1 [0153.122] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x8) returned 0x23f3e9c8340 [0153.122] RtlRestoreLastWin32Error () returned 0x9dcfeb4000 [0153.122] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x23f3e9c8340, pcchLanguagesBuffer=0x9dd00fdaa0 | out: pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x23f3e9c8340, pcchLanguagesBuffer=0x9dd00fdaa0) returned 1 [0153.122] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x8) returned 0x23f3e9c82d0 [0153.122] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3e9c8340) returned 1 [0153.122] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x14) returned 0x23f3e9e7750 [0153.123] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x23f3e9e7750, pulNumLanguages=0x9dd00fdba8 | out: pulNumLanguages=0x9dd00fdba8) returned 1 [0153.123] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3e9e7750) returned 1 [0153.138] LoadStringW (in: hInstance=0x7fffd48b0000, uID=0x3e, lpBuffer=0x9dd00fd150, cchBufferMax=256 | out: lpBuffer="Base Board") returned 0xa [0153.139] lstrlenW (lpString="Dell Inc.") returned 9 [0153.140] lstrlenW (lpString="0G3HR7") returned 6 [0153.140] lstrlenW (lpString="A00") returned 3 [0153.141] lstrlenW (lpString="..XXXXXXXXXXXXX.") returned 16 [0153.150] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x4) returned 0x23f3e9c8330 [0153.150] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x23f3e9c8330, pulNumLanguages=0x9dd00fdc50 | out: pulNumLanguages=0x9dd00fdc50) returned 1 [0153.150] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3e9c8330) returned 1 [0153.150] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3e9c82d0) returned 1 [0153.480] RtlRestoreLastWin32Error () returned 0x9dcfeb4000 [0153.480] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x9dd00fdaa0 | out: pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x9dd00fdaa0) returned 1 [0153.480] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x8) returned 0x23f3e9c82d0 [0153.480] RtlRestoreLastWin32Error () returned 0x9dcfeb4000 [0153.480] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x23f3e9c82d0, pcchLanguagesBuffer=0x9dd00fdaa0 | out: pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x23f3e9c82d0, pcchLanguagesBuffer=0x9dd00fdaa0) returned 1 [0153.480] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x8) returned 0x23f3e9c8330 [0153.480] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3e9c82d0) returned 1 [0153.480] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x14) returned 0x23f3e9b5900 [0153.480] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x23f3e9b5900, pulNumLanguages=0x9dd00fdba8 | out: pulNumLanguages=0x9dd00fdba8) returned 1 [0153.480] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3e9b5900) returned 1 [0153.482] malloc (_Size=0x600) returned 0x23f3f3291a0 [0153.483] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0x9dd00fd288 | out: Buffer=0x0, ReturnedLength=0x9dd00fd288) returned 0 [0153.483] GetLastError () returned 0x7a [0153.483] malloc (_Size=0x250) returned 0x23f3f306d60 [0153.483] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x23f3f306d60, ReturnedLength=0x9dd00fd288 | out: Buffer=0x23f3f306d60, ReturnedLength=0x9dd00fd288) returned 1 [0153.483] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0153.483] GetMaximumProcessorGroupCount () returned 0x1 [0153.483] malloc (_Size=0x40) returned 0x23f3f305b90 [0153.483] malloc (_Size=0x40) returned 0x23f3f3062c0 [0153.483] malloc (_Size=0x8) returned 0x23f3f306c80 [0153.483] memcpy (in: _Dst=0x23f3f305b90, _Src=0x23f3f306d80, _Size=0x10 | out: _Dst=0x23f3f305b90) returned 0x23f3f305b90 [0153.491] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0153.491] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0x9dd00fd280, InputBufferLength=0x2, OutputBuffer=0x23f3f3291a0, OutputBufferLength=0x60 | out: OutputBuffer=0x23f3f3291a0) returned 0x0 [0153.491] _vsnwprintf (in: _Buffer=0x9dd00fd120, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x9dd00fca18 | out: _Buffer="CPU0") returned 4 [0153.492] GetCurrentThread () returned 0xfffffffffffffffe [0153.492] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x9dd00fc970, PreviousGroupAffinity=0x9dd00fc980 | out: PreviousGroupAffinity=0x9dd00fc980) returned 1 [0153.492] GetSystemInfo (in: lpSystemInfo=0x9dd00fcab0 | out: lpSystemInfo=0x9dd00fcab0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0153.492] mbstowcs (in: _Dest=0x9dd00fcd38, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0153.492] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0153.494] mbstowcs (in: _Dest=0x9dd00fcba8, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0153.494] GetCurrentThread () returned 0xfffffffffffffffe [0153.494] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x9dd00fc980, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0153.499] LoadStringW (in: hInstance=0x7fffd48b0000, uID=0x2c, lpBuffer=0x9dd00fc780, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0155.982] malloc (_Size=0x35140) returned 0x23f3f32aae0 [0155.995] _wtoi (_String="238") returned 238 [0155.995] _wtoi (_String="6") returned 6 [0155.995] _itow (in: _Dest=0x0, _Radix=-804270000 | out: _Dest=0x0) returned="0" [0155.995] _itow (in: _Dest=0xee, _Radix=-804271712 | out: _Dest=0xee) returned="238" [0155.995] malloc (_Size=0x4000) returned 0x23f3f35fc30 [0155.995] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0x23f3f35fc30, lpcbData=0x9dd00fc974*=0x4000 | out: lpType=0x0, lpData=0x23f3f35fc30*=0x50, lpcbData=0x9dd00fc974*=0x600) returned 0x0 [0156.026] free (_Block=0x23f3f35fc30) [0156.026] Sleep (dwMilliseconds=0x3e8) [0157.042] _itow (in: _Dest=0xee, _Radix=-804271712 | out: _Dest=0xee) returned="238" [0157.042] malloc (_Size=0x4000) returned 0x23f3f35fc30 [0157.042] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0x23f3f35fc30, lpcbData=0x9dd00fc974*=0x4000 | out: lpType=0x0, lpData=0x23f3f35fc30*=0x50, lpcbData=0x9dd00fc974*=0x600) returned 0x0 [0157.094] free (_Block=0x23f3f35fc30) [0157.097] free (_Block=0x23f3f32aae0) [0157.103] _vsnwprintf (in: _Buffer=0x9dd00fd050, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0x9dd00fca18 | out: _Buffer="0F8BFBFF00050654") returned 16 [0157.106] lstrlenW (lpString=" 0") returned 2 [0157.106] lstrlenW (lpString="Intel(R) Xeon(R) Gold 6126 CPU @ 2.60GHz") returned 40 [0157.107] lstrlenW (lpString="") returned 0 [0157.107] lstrlenW (lpString="") returned 0 [0157.108] lstrlenW (lpString="") returned 0 [0157.110] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1 [0157.110] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1 [0157.113] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0157.113] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0157.113] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0157.113] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0157.113] _vsnwprintf (in: _Buffer=0x9dd00fd310, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x9dd00fd258 | out: _Buffer="CPU0") returned 4 [0157.115] free (_Block=0x23f3f306c80) [0157.116] free (_Block=0x23f3f3062c0) [0157.116] free (_Block=0x23f3f305b90) [0157.117] free (_Block=0x23f3f306d60) [0157.117] free (_Block=0x23f3f3291a0) [0157.126] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x4) returned 0x23f3f451390 [0157.126] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x23f3f451390, pulNumLanguages=0x9dd00fdc50 | out: pulNumLanguages=0x9dd00fdc50) returned 1 [0157.126] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f451390) returned 1 [0157.127] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3e9c8330) returned 1 [0157.378] RtlRestoreLastWin32Error () returned 0x9dcfeb4000 [0157.378] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x9dd00fdaa0 | out: pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x9dd00fdaa0) returned 1 [0157.378] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x8) returned 0x23f3f4514c0 [0157.378] RtlRestoreLastWin32Error () returned 0x9dcfeb4000 [0157.378] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x23f3f4514c0, pcchLanguagesBuffer=0x9dd00fdaa0 | out: pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x23f3f4514c0, pcchLanguagesBuffer=0x9dd00fdaa0) returned 1 [0157.378] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x8) returned 0x23f3f4514d0 [0157.378] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f4514c0) returned 1 [0157.378] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x14) returned 0x23f3e9d5520 [0157.378] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x23f3e9d5520, pulNumLanguages=0x9dd00fdba8 | out: pulNumLanguages=0x9dd00fdba8) returned 1 [0157.378] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3e9d5520) returned 1 [0157.387] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7fffd4a67f20 | out: lpflOldProtect=0x7fffd4a67f20*=0x2) returned 1 [0157.387] LoadLibraryExA (lpLibFileName="IPHLPAPI.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fffe5d70000 [0157.392] GetProcAddress (hModule=0x7fffe5d70000, lpProcName="GetAdaptersAddresses") returned 0x7fffe5d72a20 [0157.392] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x9dd00fd370 | out: lpflOldProtect=0x9dd00fd370*=0x4) returned 1 [0157.392] GetAdaptersAddresses (in: Family=0x0, Flags=0x0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x9dd00fd448*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x9dd00fd448*=0x1128) returned 0x6f [0157.422] malloc (_Size=0x1128) returned 0x23f3f307160 [0157.422] GetAdaptersAddresses (in: Family=0x0, Flags=0x0, Reserved=0x0, AdapterAddresses=0x23f3f307160, SizePointer=0x9dd00fd448*=0x1128 | out: AdapterAddresses=0x23f3f307160*(Alignment=0x6000001c0, Length=0x1c0, IfIndex=0x6, Next=0x23f3f307720, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x23f3f3073d0, FirstAnycastAddress=0x0, FirstMulticastAddress=0x23f3f307480, FirstDnsServerAddress=0x23f3f3076f0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0xa0, [1]=0xbf, [2]=0x50, [3]=0xe2, [4]=0x37, [5]=0xdc, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x6, ZoneIndices=([0]=0x6, [1]=0x6, [2]=0x6, [3]=0x6, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x23f3f307320*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x9dd00fd448*=0x1128) returned 0x0 [0157.436] malloc (_Size=0x68) returned 0x23f3f300300 [0157.436] memcpy (in: _Dst=0x23f3f30034c, _Src=0x23f3f3071b0, _Size=0x6 | out: _Dst=0x23f3f30034c) returned 0x23f3f30034c [0157.436] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7fffd4a67f20 | out: lpflOldProtect=0x7fffd4a67f20*=0x2) returned 1 [0157.437] GetProcAddress (hModule=0x7fffe5d70000, lpProcName="GetIpForwardTable2") returned 0x7fffe5d7a540 [0157.437] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x9dd00fd2e0 | out: lpflOldProtect=0x9dd00fd2e0*=0x4) returned 1 [0157.437] GetIpForwardTable2 () returned 0x0 [0157.439] malloc (_Size=0x20) returned 0x23f3f329f40 [0157.439] RtlIpv6AddressToStringW () returned 0x9dd00fd2a0 [0157.440] malloc (_Size=0x20) returned 0x23f3f329eb0 [0157.440] RtlIpv4AddressToStringW () returned 0x9dd00fd288 [0157.440] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7fffd4a67f20 | out: lpflOldProtect=0x7fffd4a67f20*=0x2) returned 1 [0157.440] GetProcAddress (hModule=0x7fffe5d70000, lpProcName="ConvertLengthToIpv4Mask") returned 0x7fffe5d71c40 [0157.440] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x9dd00fd1d0 | out: lpflOldProtect=0x9dd00fd1d0*=0x4) returned 1 [0157.441] ConvertLengthToIpv4Mask (in: MaskLength=0x18, Mask=0x9dd00fd258 | out: Mask=0x9dd00fd258) returned 0x0 [0157.441] RtlIpv4AddressToStringW () returned 0x9dd00fd28a [0157.441] malloc (_Size=0x20) returned 0x23f3f32a030 [0157.441] RtlIpv4AddressToStringW () returned 0x9dd00fd286 [0157.441] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7fffd4a67f20 | out: lpflOldProtect=0x7fffd4a67f20*=0x2) returned 1 [0157.441] GetProcAddress (hModule=0x7fffe5d70000, lpProcName="FreeMibTable") returned 0x7fffe5d72840 [0157.442] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x9dd00fd2e0 | out: lpflOldProtect=0x9dd00fd2e0*=0x4) returned 1 [0157.442] FreeMibTable () returned 0x1 [0157.442] malloc (_Size=0x68) returned 0x23f3f300680 [0157.442] GetIpForwardTable2 () returned 0x0 [0157.443] malloc (_Size=0x20) returned 0x23f3f329e80 [0157.443] RtlIpv6AddressToStringW () returned 0x9dd00fd276 [0157.443] malloc (_Size=0x20) returned 0x23f3f329ee0 [0157.443] RtlIpv4AddressToStringW () returned 0x9dd00fd282 [0157.443] ConvertLengthToIpv4Mask (in: MaskLength=0x8, Mask=0x9dd00fd258 | out: Mask=0x9dd00fd258) returned 0x0 [0157.443] RtlIpv4AddressToStringW () returned 0x9dd00fd282 [0157.443] FreeMibTable () returned 0x1 [0157.443] malloc (_Size=0x68) returned 0x23f3f300760 [0157.443] malloc (_Size=0x68) returned 0x23f3f308350 [0157.444] memcpy (in: _Dst=0x23f3f30839c, _Src=0x23f3f307ef8, _Size=0x8 | out: _Dst=0x23f3f30839c) returned 0x23f3f30839c [0157.444] GetIpForwardTable2 () returned 0x0 [0157.444] malloc (_Size=0x20) returned 0x23f3f32a0f0 [0157.444] RtlIpv6AddressToStringW () returned 0x9dd00fd2b8 [0157.444] malloc (_Size=0x20) returned 0x23f3f329ac0 [0157.444] RtlIpv6AddressToStringW () returned 0x9dd00fd2a2 [0157.444] malloc (_Size=0x20) returned 0x23f3f329d30 [0157.444] RtlIpv6AddressToStringW () returned 0x9dd00fd274 [0157.444] FreeMibTable () returned 0x1 [0157.446] free (_Block=0x23f3f307160) [0157.448] _vsnwprintf (in: _Buffer=0x9dd00fd180, _BufferCount=0x105, _Format="SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}", _ArgList=0x9dd00fc198 | out: _Buffer="SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}") returned 77 [0157.450] _wtol (_String="0000") returned 0 [0157.453] malloc (_Size=0x48) returned 0x23f3f306270 [0157.454] _wtol (_String="0001") returned 1 [0157.456] malloc (_Size=0x48) returned 0x23f3f3054b0 [0157.457] _wtol (_String="0002") returned 2 [0157.458] malloc (_Size=0x48) returned 0x23f3f305870 [0157.459] _wtol (_String="0003") returned 3 [0157.460] malloc (_Size=0x48) returned 0x23f3f3056e0 [0157.461] _wtol (_String="0004") returned 4 [0157.463] malloc (_Size=0x48) returned 0x23f3f306180 [0157.464] _wtol (_String="Configuration") returned 0 [0157.465] _wtol (_String="Properties") returned 0 [0157.478] QueryDosDeviceW (in: lpDeviceName="{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", lpTargetPath=0x9dd00fbea0, ucchMax=0x200 | out: lpTargetPath="넁￿") returned 0x0 [0157.478] GetLastError () returned 0x2 [0157.479] DefineDosDeviceW (dwFlags=0x1, lpDeviceName="{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", lpTargetPath="\\Device\\{017EF944-8C88-42C3-8F92-C8F7B6022F8D}") returned 1 [0157.487] CreateFileW (lpFileName="\\\\.\\{017EF944-8C88-42C3-8F92-C8F7B6022F8D}" (normalized: "{017ef944-8c88-42c3-8f92-c8f7b6022f8d}"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0xffffffffffffffff [0157.488] DefineDosDeviceW (dwFlags=0x7, lpDeviceName="{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", lpTargetPath="\\Device\\{017EF944-8C88-42C3-8F92-C8F7B6022F8D}") returned 1 [0157.495] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7fffe5d70000 [0157.495] GetProcAddress (hModule=0x7fffe5d70000, lpProcName="GetAdapterIndex") returned 0x7fffe5d8ddb0 [0157.496] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{017EF944-8C88-42C3-8F92-C8F7B6022F8D}", IfIndex=0x9dd00fd410 | out: IfIndex=0x9dd00fd410) returned 0x0 [0157.497] FreeLibrary (hLibModule=0x7fffe5d70000) returned 1 [0157.499] QueryDosDeviceW (in: lpDeviceName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", lpTargetPath=0x9dd00fbea0, ucchMax=0x200 | out: lpTargetPath="") returned 0x0 [0157.499] GetLastError () returned 0x2 [0157.499] DefineDosDeviceW (dwFlags=0x1, lpDeviceName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", lpTargetPath="\\Device\\{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}") returned 1 [0157.507] CreateFileW (lpFileName="\\\\.\\{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}" (normalized: "{e25a642b-6ceb-4194-8f83-8bc82af94f5a}"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0xffffffffffffffff [0157.507] DefineDosDeviceW (dwFlags=0x7, lpDeviceName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", lpTargetPath="\\Device\\{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}") returned 1 [0157.512] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7fffe5d70000 [0157.513] GetProcAddress (hModule=0x7fffe5d70000, lpProcName="GetAdapterIndex") returned 0x7fffe5d8ddb0 [0157.513] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", IfIndex=0x9dd00fd410 | out: IfIndex=0x9dd00fd410) returned 0x0 [0157.513] FreeLibrary (hLibModule=0x7fffe5d70000) returned 1 [0157.515] QueryDosDeviceW (in: lpDeviceName="{9E8A7ED5-49C8-421B-A782-D46C28931105}", lpTargetPath=0x9dd00fbea0, ucchMax=0x200 | out: lpTargetPath="\\Device\\NDMP6") returned 0xf [0157.515] CreateFileW (lpFileName="\\\\.\\{9E8A7ED5-49C8-421B-A782-D46C28931105}" (normalized: "\\device\\ndmp6"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0x460 [0157.515] DeviceIoControl (in: hDevice=0x460, dwIoControlCode=0x170002, lpInBuffer=0x9dd00fc300*, nInBufferSize=0x4, lpOutBuffer=0x9dd00fc340, nOutBufferSize=0x1000, lpBytesReturned=0x9dd00fc304, lpOverlapped=0x0 | out: lpInBuffer=0x9dd00fc300*, lpOutBuffer=0x9dd00fc340*, lpBytesReturned=0x9dd00fc304*=0x4, lpOverlapped=0x0) returned 1 [0157.516] DeviceIoControl (in: hDevice=0x460, dwIoControlCode=0x170002, lpInBuffer=0x9dd00fc300*, nInBufferSize=0x4, lpOutBuffer=0x9dd00fc340, nOutBufferSize=0x1000, lpBytesReturned=0x9dd00fc304, lpOverlapped=0x0 | out: lpInBuffer=0x9dd00fc300*, lpOutBuffer=0x9dd00fc340*, lpBytesReturned=0x9dd00fc304*=0xc, lpOverlapped=0x0) returned 1 [0157.516] CloseHandle (hObject=0x460) returned 1 [0157.519] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7fffe5d70000 [0157.519] GetProcAddress (hModule=0x7fffe5d70000, lpProcName="GetAdapterIndex") returned 0x7fffe5d8ddb0 [0157.520] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{9E8A7ED5-49C8-421B-A782-D46C28931105}", IfIndex=0x9dd00fd410 | out: IfIndex=0x9dd00fd410) returned 0x0 [0157.520] FreeLibrary (hLibModule=0x7fffe5d70000) returned 1 [0157.522] QueryDosDeviceW (in: lpDeviceName="{C2998852-8A8B-426B-AAB1-8880E47F8B1A}", lpTargetPath=0x9dd00fbea0, ucchMax=0x200 | out: lpTargetPath="\\Device\\NDMP7") returned 0xf [0157.522] CreateFileW (lpFileName="\\\\.\\{C2998852-8A8B-426B-AAB1-8880E47F8B1A}" (normalized: "\\device\\ndmp7"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0x460 [0157.522] DeviceIoControl (in: hDevice=0x460, dwIoControlCode=0x170002, lpInBuffer=0x9dd00fc300*, nInBufferSize=0x4, lpOutBuffer=0x9dd00fc340, nOutBufferSize=0x1000, lpBytesReturned=0x9dd00fc304, lpOverlapped=0x0 | out: lpInBuffer=0x9dd00fc300*, lpOutBuffer=0x9dd00fc340*, lpBytesReturned=0x9dd00fc304*=0x4, lpOverlapped=0x0) returned 1 [0157.522] DeviceIoControl (in: hDevice=0x460, dwIoControlCode=0x170002, lpInBuffer=0x9dd00fc300*, nInBufferSize=0x4, lpOutBuffer=0x9dd00fc340, nOutBufferSize=0x1000, lpBytesReturned=0x9dd00fc304, lpOverlapped=0x0 | out: lpInBuffer=0x9dd00fc300*, lpOutBuffer=0x9dd00fc340*, lpBytesReturned=0x9dd00fc304*=0x20, lpOverlapped=0x0) returned 1 [0157.522] CloseHandle (hObject=0x460) returned 1 [0157.529] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7fffe5d70000 [0157.529] GetProcAddress (hModule=0x7fffe5d70000, lpProcName="GetAdapterIndex") returned 0x7fffe5d8ddb0 [0157.529] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{C2998852-8A8B-426B-AAB1-8880E47F8B1A}", IfIndex=0x9dd00fd410 | out: IfIndex=0x9dd00fd410) returned 0x0 [0157.530] FreeLibrary (hLibModule=0x7fffe5d70000) returned 1 [0157.531] QueryDosDeviceW (in: lpDeviceName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", lpTargetPath=0x9dd00fbea0, ucchMax=0x200 | out: lpTargetPath="\\Device\\NDMP4") returned 0xf [0157.532] CreateFileW (lpFileName="\\\\.\\{E96D977E-F067-4CE9-924D-F6E0A04729E4}" (normalized: "\\device\\ndmp4"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0xffffffffffffffff) returned 0x460 [0157.532] DeviceIoControl (in: hDevice=0x460, dwIoControlCode=0x170002, lpInBuffer=0x9dd00fc300*, nInBufferSize=0x4, lpOutBuffer=0x9dd00fc340, nOutBufferSize=0x1000, lpBytesReturned=0x9dd00fc304, lpOverlapped=0x0 | out: lpInBuffer=0x9dd00fc300*, lpOutBuffer=0x9dd00fc340*, lpBytesReturned=0x9dd00fc304*=0x4, lpOverlapped=0x0) returned 1 [0157.532] DeviceIoControl (in: hDevice=0x460, dwIoControlCode=0x170002, lpInBuffer=0x9dd00fc300*, nInBufferSize=0x4, lpOutBuffer=0x9dd00fc340, nOutBufferSize=0x1000, lpBytesReturned=0x9dd00fc304, lpOverlapped=0x0 | out: lpInBuffer=0x9dd00fc300*, lpOutBuffer=0x9dd00fc340*, lpBytesReturned=0x9dd00fc304*=0x6, lpOverlapped=0x0) returned 1 [0157.532] CloseHandle (hObject=0x460) returned 1 [0157.536] malloc (_Size=0x18) returned 0x23f3f301ee0 [0157.537] malloc (_Size=0x18) returned 0x23f3f302000 [0157.537] SafeArrayPutElement (psa=0x23f3ea00a20, rgIndices=0x9dd00fd000, pv=0x23f3e9fb9b8) returned 0x0 [0157.537] malloc (_Size=0x18) returned 0x23f3f301da0 [0157.537] SafeArrayPutElement (psa=0x23f3e9ffe60, rgIndices=0x9dd00fd000, pv=0x23f3ea00a58) returned 0x0 [0157.537] free (_Block=0x23f3f301da0) [0157.537] free (_Block=0x23f3f302000) [0157.537] malloc (_Size=0x18) returned 0x23f3f302000 [0157.537] SafeArrayPutElement (psa=0x23f3ea00a20, rgIndices=0x9dd00fd000, pv=0x23f3e9fb9b8) returned 0x0 [0157.537] malloc (_Size=0x18) returned 0x23f3f301ca0 [0157.537] SafeArrayPutElement (psa=0x23f3e9ffe60, rgIndices=0x9dd00fd000, pv=0x23f3ea08268) returned 0x0 [0157.537] free (_Block=0x23f3f301ca0) [0157.537] free (_Block=0x23f3f302000) [0157.537] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x78) returned 0x23f3ea845f0 [0157.537] SafeArrayGetDim (psa=0x23f3ea00a20) returned 0x1 [0157.537] SafeArrayGetLBound (in: psa=0x23f3ea00a20, nDim=0x1, plLbound=0x9dd00fccf0 | out: plLbound=0x9dd00fccf0) returned 0x0 [0157.537] SafeArrayGetUBound (in: psa=0x23f3ea00a20, nDim=0x1, plUbound=0x9dd00fcd10 | out: plUbound=0x9dd00fcd10) returned 0x0 [0157.537] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x28) returned 0x23f3ea08170 [0157.537] SafeArrayGetDim (psa=0x23f3ea00a20) returned 0x1 [0157.537] SafeArrayGetUBound (in: psa=0x23f3ea00a20, nDim=0x1, plUbound=0x9dd00fccb8 | out: plUbound=0x9dd00fccb8) returned 0x0 [0157.537] SafeArrayGetElemsize (psa=0x23f3ea00a20) returned 0x8 [0157.538] SafeArrayGetElement (in: psa=0x23f3ea00a20, rgIndices=0x9dd00fcba8, pv=0x9dd00fcbb0 | out: pv=0x9dd00fcbb0) returned 0x0 [0157.538] memcpy (in: _Dst=0x9dd00fcbb8, _Src=0x23f3e9d5780, _Size=0x8 | out: _Dst=0x9dd00fcbb8) returned 0x9dd00fcbb8 [0157.538] memcpy (in: _Dst=0x9dd00fcbb8, _Src=0x23f3e9d5788, _Size=0x8 | out: _Dst=0x9dd00fcbb8) returned 0x9dd00fcbb8 [0157.539] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea08170) returned 1 [0157.540] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea845f0) returned 1 [0157.540] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x78) returned 0x23f3ea846f0 [0157.540] SafeArrayGetDim (psa=0x23f3e9ffe60) returned 0x1 [0157.540] SafeArrayGetLBound (in: psa=0x23f3e9ffe60, nDim=0x1, plLbound=0x9dd00fccf0 | out: plLbound=0x9dd00fccf0) returned 0x0 [0157.540] SafeArrayGetUBound (in: psa=0x23f3e9ffe60, nDim=0x1, plUbound=0x9dd00fcd10 | out: plUbound=0x9dd00fcd10) returned 0x0 [0157.540] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x28) returned 0x23f3ea08170 [0157.540] SafeArrayGetDim (psa=0x23f3e9ffe60) returned 0x1 [0157.540] SafeArrayGetUBound (in: psa=0x23f3e9ffe60, nDim=0x1, plUbound=0x9dd00fccb8 | out: plUbound=0x9dd00fccb8) returned 0x0 [0157.540] SafeArrayGetElemsize (psa=0x23f3e9ffe60) returned 0x8 [0157.540] SafeArrayGetElement (in: psa=0x23f3e9ffe60, rgIndices=0x9dd00fcba8, pv=0x9dd00fcbb0 | out: pv=0x9dd00fcbb0) returned 0x0 [0157.541] memcpy (in: _Dst=0x9dd00fcbb8, _Src=0x23f3e9d5820, _Size=0x8 | out: _Dst=0x9dd00fcbb8) returned 0x9dd00fcbb8 [0157.541] memcpy (in: _Dst=0x9dd00fcbb8, _Src=0x23f3e9d5828, _Size=0x8 | out: _Dst=0x9dd00fcbb8) returned 0x9dd00fcbb8 [0157.542] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea08170) returned 1 [0157.542] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea846f0) returned 1 [0157.542] free (_Block=0x23f3f301ee0) [0157.543] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7fffd4a67f20 | out: lpflOldProtect=0x7fffd4a67f20*=0x2) returned 1 [0157.544] GetProcAddress (hModule=0x7ffff00c0000, lpProcName=0x10) returned 0x7ffff00d0e10 [0157.544] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x9dd00fceb0 | out: lpflOldProtect=0x9dd00fceb0*=0x4) returned 1 [0157.544] malloc (_Size=0x18) returned 0x23f3f301ba0 [0157.544] SafeArrayPutElement (psa=0x23f3ea00160, rgIndices=0x9dd00fd000, pv=0x23f3ea08268) returned 0x0 [0157.544] SafeArrayPutElement (psa=0x23f3ea00220, rgIndices=0x9dd00fd000, pv=0x23f3f32a04c) returned 0x0 [0157.544] free (_Block=0x23f3f301ba0) [0157.544] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x78) returned 0x23f3ea83e70 [0157.544] SafeArrayGetDim (psa=0x23f3ea00160) returned 0x1 [0157.544] SafeArrayGetLBound (in: psa=0x23f3ea00160, nDim=0x1, plLbound=0x9dd00fccf0 | out: plLbound=0x9dd00fccf0) returned 0x0 [0157.544] SafeArrayGetUBound (in: psa=0x23f3ea00160, nDim=0x1, plUbound=0x9dd00fcd10 | out: plUbound=0x9dd00fcd10) returned 0x0 [0157.544] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x28) returned 0x23f3ea08170 [0157.544] SafeArrayGetDim (psa=0x23f3ea00160) returned 0x1 [0157.544] SafeArrayGetUBound (in: psa=0x23f3ea00160, nDim=0x1, plUbound=0x9dd00fccb8 | out: plUbound=0x9dd00fccb8) returned 0x0 [0157.544] SafeArrayGetElemsize (psa=0x23f3ea00160) returned 0x8 [0157.545] SafeArrayGetElement (in: psa=0x23f3ea00160, rgIndices=0x9dd00fcba8, pv=0x9dd00fcbb0 | out: pv=0x9dd00fcbb0) returned 0x0 [0157.545] memcpy (in: _Dst=0x9dd00fcbb8, _Src=0x23f3f4515a0, _Size=0x8 | out: _Dst=0x9dd00fcbb8) returned 0x9dd00fcbb8 [0157.546] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea08170) returned 1 [0157.546] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea83e70) returned 1 [0157.546] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x78) returned 0x23f3ea847f0 [0157.546] SafeArrayGetDim (psa=0x23f3ea00220) returned 0x1 [0157.546] SafeArrayGetLBound (in: psa=0x23f3ea00220, nDim=0x1, plLbound=0x9dd00fccf0 | out: plLbound=0x9dd00fccf0) returned 0x0 [0157.546] SafeArrayGetUBound (in: psa=0x23f3ea00220, nDim=0x1, plUbound=0x9dd00fcd10 | out: plUbound=0x9dd00fcd10) returned 0x0 [0157.546] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x28) returned 0x23f3ea08170 [0157.546] SafeArrayGetDim (psa=0x23f3ea00220) returned 0x1 [0157.546] SafeArrayGetUBound (in: psa=0x23f3ea00220, nDim=0x1, plUbound=0x9dd00fccb8 | out: plUbound=0x9dd00fccb8) returned 0x0 [0157.546] SafeArrayGetElemsize (psa=0x23f3ea00220) returned 0x4 [0157.547] SafeArrayGetElement (in: psa=0x23f3ea00220, rgIndices=0x9dd00fcbb0, pv=0x9dd00fcc00 | out: pv=0x9dd00fcc00) returned 0x0 [0157.547] SafeArrayGetElement (in: psa=0x23f3ea00220, rgIndices=0x9dd00fcbb0, pv=0x9dd00fcc00 | out: pv=0x9dd00fcc00) returned 0x0 [0157.547] memcpy (in: _Dst=0x9dd00fcbb8, _Src=0x23f3f451630, _Size=0x4 | out: _Dst=0x9dd00fcbb8) returned 0x9dd00fcbb8 [0157.549] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea08170) returned 1 [0157.550] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea847f0) returned 1 [0157.551] _wtol (_String="1704792246") returned 1704792246 [0157.551] _wtol (_String="1704788646") returned 1704788646 [0157.556] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x78) returned 0x23f3ea840f0 [0157.557] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea840f0) returned 1 [0157.557] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x78) returned 0x23f3ea84cf0 [0157.558] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea84cf0) returned 1 [0157.558] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x78) returned 0x23f3ea84170 [0157.559] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea84170) returned 1 [0157.563] GetProcessHeap () returned 0x23f3e9a0000 [0157.563] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x8, Size=0x1c0) returned 0x23f3ea94810 [0157.563] GetAdaptersAddresses (in: Family=0x0, Flags=0x6f, Reserved=0x0, AdapterAddresses=0x23f3ea94810, SizePointer=0x9dd00fcb50*=0x1c0 | out: AdapterAddresses=0x23f3ea94810*(Alignment=0x0, Length=0x0, IfIndex=0x0, Next=0x0, AdapterName=0x0, FirstUnicastAddress=0x0, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix=0x0, Description=0x0, FriendlyName=0x0, PhysicalAddress=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x0, Flags=0x0, DdnsEnabled=0x0, RegisterAdapterSuffix=0x0, Dhcpv4Enabled=0x0, ReceiveOnly=0x0, NoMulticast=0x0, Ipv6OtherStatefulConfig=0x0, NetbiosOverTcpipEnabled=0x0, Ipv4Enabled=0x0, Ipv6Enabled=0x0, Ipv6ManagedAddressConfigurationSupported=0x0, Mtu=0x0, IfType=0x0, OperStatus=0x0, Ipv6IfIndex=0x0, ZoneIndices=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0), FirstPrefix=0x0, TransmitLinkSpeed=0x0, ReceiveLinkSpeed=0x0, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0x0, Ipv6Metric=0x0, Luid=0x0, Dhcpv4Server.lpSockaddr=0x0, Dhcpv4Server.iSockaddrLength=0, CompartmentId=0x0, NetworkGuid=0x0, ConnectionType=0x0, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0x0, Dhcpv6Iaid=0x0, FirstDnsSuffix=0x0), SizePointer=0x9dd00fcb50*=0x9a8) returned 0x6f [0157.568] GetProcessHeap () returned 0x23f3e9a0000 [0157.568] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea94810) returned 1 [0157.568] GetProcessHeap () returned 0x23f3e9a0000 [0157.568] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x8, Size=0x9a8) returned 0x23f3f4617f0 [0157.568] GetAdaptersAddresses (in: Family=0x0, Flags=0x6f, Reserved=0x0, AdapterAddresses=0x23f3f4617f0, SizePointer=0x9dd00fcb50*=0x9a8 | out: AdapterAddresses=0x23f3f4617f0*(Alignment=0x6000001c0, Length=0x1c0, IfIndex=0x6, Next=0x23f3f461a60, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x0, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0xa0, [1]=0xbf, [2]=0x50, [3]=0xe2, [4]=0x37, [5]=0xdc, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x6, ZoneIndices=([0]=0x6, [1]=0x6, [2]=0x6, [3]=0x6, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x23f3f4619b0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x9dd00fcb50*=0x9a8) returned 0x0 [0157.573] GetProcessHeap () returned 0x23f3e9a0000 [0157.573] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f4617f0) returned 1 [0157.577] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7fffd4a67f20 | out: lpflOldProtect=0x7fffd4a67f20*=0x2) returned 1 [0157.577] LoadLibraryExA (lpLibFileName="DNSAPI.dll", hFile=0x0, dwFlags=0x0) returned 0x7fffeb830000 [0157.583] GetProcAddress (hModule=0x7fffeb830000, lpProcName="DnsQueryConfigAllocEx") returned 0x7fffeb836cf0 [0157.583] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x9dd00fcf80 | out: lpflOldProtect=0x9dd00fcf80*=0x4) returned 1 [0157.583] DnsQueryConfigAllocEx () returned 0x23f3ea94810 [0157.592] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7fffd4a67f20 | out: lpflOldProtect=0x7fffd4a67f20*=0x2) returned 1 [0157.592] GetProcAddress (hModule=0x7fffeb830000, lpProcName="DnsFreeConfigStructure") returned 0x7fffeb86c9a0 [0157.592] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x9dd00fcf80 | out: lpflOldProtect=0x9dd00fcf80*=0x4) returned 1 [0157.593] DnsFreeConfigStructure () returned 0x1 [0157.594] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7fffd4a67f20 | out: lpflOldProtect=0x7fffd4a67f20*=0x2) returned 1 [0157.594] GetProcAddress (hModule=0x7fffeb830000, lpProcName="DnsQueryConfigDword") returned 0x7fffeb836bc0 [0157.594] VirtualProtect (in: lpAddress=0x7fffd4a7a000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x9dd00fcf80 | out: lpflOldProtect=0x9dd00fcf80*=0x4) returned 1 [0157.594] DnsQueryConfigDword () returned 0x1 [0157.595] DnsQueryConfigDword () returned 0x0 [0157.597] malloc (_Size=0x18) returned 0x23f3f3019a0 [0157.597] SafeArrayPutElement (psa=0x23f3ea00260, rgIndices=0x9dd00fcd10, pv=0x23f3ea08268) returned 0x0 [0157.597] free (_Block=0x23f3f3019a0) [0157.598] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x78) returned 0x23f3ea840f0 [0157.598] SafeArrayGetDim (psa=0x23f3ea00260) returned 0x1 [0157.598] SafeArrayGetLBound (in: psa=0x23f3ea00260, nDim=0x1, plLbound=0x9dd00fcd90 | out: plLbound=0x9dd00fcd90) returned 0x0 [0157.598] SafeArrayGetUBound (in: psa=0x23f3ea00260, nDim=0x1, plUbound=0x9dd00fcdb0 | out: plUbound=0x9dd00fcdb0) returned 0x0 [0157.598] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x28) returned 0x23f3f461570 [0157.598] SafeArrayGetDim (psa=0x23f3ea00260) returned 0x1 [0157.599] SafeArrayGetUBound (in: psa=0x23f3ea00260, nDim=0x1, plUbound=0x9dd00fcd58 | out: plUbound=0x9dd00fcd58) returned 0x0 [0157.599] SafeArrayGetElemsize (psa=0x23f3ea00260) returned 0x8 [0157.599] SafeArrayGetElement (in: psa=0x23f3ea00260, rgIndices=0x9dd00fcc48, pv=0x9dd00fcc50 | out: pv=0x9dd00fcc50) returned 0x0 [0157.599] memcpy (in: _Dst=0x9dd00fcc58, _Src=0x23f3f4514a0, _Size=0x8 | out: _Dst=0x9dd00fcc58) returned 0x9dd00fcc58 [0157.600] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f461570) returned 1 [0157.601] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea840f0) returned 1 [0157.601] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x78) returned 0x23f3ea853f0 [0157.601] SafeArrayGetDim (psa=0x23f3ea00220) returned 0x1 [0157.601] SafeArrayGetLBound (in: psa=0x23f3ea00220, nDim=0x1, plLbound=0x9dd00fcd90 | out: plLbound=0x9dd00fcd90) returned 0x0 [0157.601] SafeArrayGetUBound (in: psa=0x23f3ea00220, nDim=0x1, plUbound=0x9dd00fcdb0 | out: plUbound=0x9dd00fcdb0) returned 0x0 [0157.601] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x28) returned 0x23f3f461540 [0157.601] SafeArrayGetDim (psa=0x23f3ea00220) returned 0x1 [0157.601] SafeArrayGetUBound (in: psa=0x23f3ea00220, nDim=0x1, plUbound=0x9dd00fcd58 | out: plUbound=0x9dd00fcd58) returned 0x0 [0157.601] SafeArrayGetElemsize (psa=0x23f3ea00220) returned 0x8 [0157.602] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f461540) returned 1 [0157.602] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3ea853f0) returned 1 [0157.605] LoadLibraryExW (lpLibFileName="iphlpapi.dll", hFile=0x0, dwFlags=0x0) returned 0x7fffe5d70000 [0157.605] GetProcAddress (hModule=0x7fffe5d70000, lpProcName="GetAdapterIndex") returned 0x7fffe5d8ddb0 [0157.605] GetAdapterIndex (in: AdapterName="\\DEVICE\\TCPIP_{E96D977E-F067-4CE9-924D-F6E0A04729E4}", IfIndex=0x9dd00fd410 | out: IfIndex=0x9dd00fd410) returned 0x0 [0157.606] FreeLibrary (hLibModule=0x7fffe5d70000) returned 1 [0157.607] free (_Block=0x23f3f306270) [0157.608] free (_Block=0x23f3f3054b0) [0157.609] free (_Block=0x23f3f305870) [0157.609] free (_Block=0x23f3f3056e0) [0157.610] free (_Block=0x23f3f306180) [0157.611] free (_Block=0x23f3f329f40) [0157.611] free (_Block=0x23f3f329eb0) [0157.612] free (_Block=0x23f3f32a030) [0157.612] free (_Block=0x23f3f300300) [0157.613] free (_Block=0x23f3f329e80) [0157.613] free (_Block=0x23f3f329ee0) [0157.614] free (_Block=0x23f3f300680) [0157.615] free (_Block=0x23f3f300760) [0157.615] free (_Block=0x23f3f32a0f0) [0157.616] free (_Block=0x23f3f329ac0) [0157.616] free (_Block=0x23f3f329d30) [0157.617] free (_Block=0x23f3f308350) [0157.636] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x4) returned 0x23f3f4514b0 [0157.636] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x23f3f4514b0, pulNumLanguages=0x9dd00fdc50 | out: pulNumLanguages=0x9dd00fdc50) returned 1 [0157.636] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f4514b0) returned 1 [0157.636] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f4514d0) returned 1 [0159.047] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0159.224] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0161.347] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0161.632] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0161.719] RtlRestoreLastWin32Error () returned 0x9dcfeb4000 [0161.719] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x9dd00fdaa0 | out: pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x9dd00fdaa0) returned 1 [0161.719] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x8) returned 0x23f3f4514c0 [0161.720] RtlRestoreLastWin32Error () returned 0x9dcfeb4000 [0161.720] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x23f3f4514c0, pcchLanguagesBuffer=0x9dd00fdaa0 | out: pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x23f3f4514c0, pcchLanguagesBuffer=0x9dd00fdaa0) returned 1 [0161.720] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x8) returned 0x23f3f451540 [0161.720] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f4514c0) returned 1 [0161.720] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x14) returned 0x23f3e9d54c0 [0161.720] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x23f3e9d54c0, pulNumLanguages=0x9dd00fdba8 | out: pulNumLanguages=0x9dd00fdba8) returned 1 [0161.720] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3e9d54c0) returned 1 [0161.727] malloc (_Size=0x600) returned 0x23f3f307160 [0161.727] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0x9dd00fd288 | out: Buffer=0x0, ReturnedLength=0x9dd00fd288) returned 0 [0161.727] GetLastError () returned 0x7a [0161.727] malloc (_Size=0x250) returned 0x23f3f306d60 [0161.727] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x23f3f306d60, ReturnedLength=0x9dd00fd288 | out: Buffer=0x23f3f306d60, ReturnedLength=0x9dd00fd288) returned 1 [0161.727] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0161.727] GetMaximumProcessorGroupCount () returned 0x1 [0161.727] malloc (_Size=0x40) returned 0x23f3f305eb0 [0161.728] malloc (_Size=0x40) returned 0x23f3f305aa0 [0161.728] malloc (_Size=0x8) returned 0x23f3f306d40 [0161.728] memcpy (in: _Dst=0x23f3f305eb0, _Src=0x23f3f306d80, _Size=0x10 | out: _Dst=0x23f3f305eb0) returned 0x23f3f305eb0 [0161.728] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0161.728] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0x9dd00fd280, InputBufferLength=0x2, OutputBuffer=0x23f3f307160, OutputBufferLength=0x60 | out: OutputBuffer=0x23f3f307160) returned 0x0 [0161.728] _vsnwprintf (in: _Buffer=0x9dd00fd120, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x9dd00fca18 | out: _Buffer="CPU0") returned 4 [0161.729] GetCurrentThread () returned 0xfffffffffffffffe [0161.729] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x9dd00fc970, PreviousGroupAffinity=0x9dd00fc980 | out: PreviousGroupAffinity=0x9dd00fc980) returned 1 [0161.729] GetSystemInfo (in: lpSystemInfo=0x9dd00fcab0 | out: lpSystemInfo=0x9dd00fcab0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0161.730] mbstowcs (in: _Dest=0x9dd00fcd38, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0161.730] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0161.731] mbstowcs (in: _Dest=0x9dd00fcba8, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0161.731] GetCurrentThread () returned 0xfffffffffffffffe [0161.731] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x9dd00fc980, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0161.737] LoadStringW (in: hInstance=0x7fffd48b0000, uID=0x2c, lpBuffer=0x9dd00fc780, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0161.801] malloc (_Size=0x35140) returned 0x23f3f32a1c0 [0161.813] _wtoi (_String="238") returned 238 [0161.813] _wtoi (_String="6") returned 6 [0161.813] _itow (in: _Dest=0x0, _Radix=-804270000 | out: _Dest=0x0) returned="0" [0161.813] _itow (in: _Dest=0xee, _Radix=-804271712 | out: _Dest=0xee) returned="238" [0161.813] malloc (_Size=0x4000) returned 0x23f3f35f310 [0161.813] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0x23f3f35f310, lpcbData=0x9dd00fc974*=0x4000 | out: lpType=0x0, lpData=0x23f3f35f310*=0x50, lpcbData=0x9dd00fc974*=0x600) returned 0x0 [0161.815] free (_Block=0x23f3f35f310) [0161.815] Sleep (dwMilliseconds=0x3e8) [0162.816] _itow (in: _Dest=0xee, _Radix=-804271712 | out: _Dest=0xee) returned="238" [0162.817] malloc (_Size=0x4000) returned 0x23f3f35f310 [0162.817] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0x23f3f35f310, lpcbData=0x9dd00fc974*=0x4000 | out: lpType=0x0, lpData=0x23f3f35f310*=0x50, lpcbData=0x9dd00fc974*=0x600) returned 0x0 [0162.819] free (_Block=0x23f3f35f310) [0162.821] free (_Block=0x23f3f32a1c0) [0162.828] _vsnwprintf (in: _Buffer=0x9dd00fd050, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0x9dd00fca18 | out: _Buffer="0F8BFBFF00050654") returned 16 [0162.830] lstrlenW (lpString=" 0") returned 2 [0162.830] lstrlenW (lpString="Intel(R) Xeon(R) Gold 6126 CPU @ 2.60GHz") returned 40 [0162.831] lstrlenW (lpString="") returned 0 [0162.831] lstrlenW (lpString="") returned 0 [0162.832] lstrlenW (lpString="") returned 0 [0162.834] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1 [0162.835] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1 [0162.836] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0162.836] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0162.836] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0162.836] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0162.836] _vsnwprintf (in: _Buffer=0x9dd00fd310, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x9dd00fd258 | out: _Buffer="CPU0") returned 4 [0162.837] free (_Block=0x23f3f306d40) [0162.838] free (_Block=0x23f3f305aa0) [0162.839] free (_Block=0x23f3f305eb0) [0162.839] free (_Block=0x23f3f306d60) [0162.839] free (_Block=0x23f3f307160) [0162.896] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x4) returned 0x23f3f451380 [0162.896] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x23f3f451380, pulNumLanguages=0x9dd00fdc50 | out: pulNumLanguages=0x9dd00fdc50) returned 1 [0162.896] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f451380) returned 1 [0162.896] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f451540) returned 1 [0163.046] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0163.222] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0163.384] RtlRestoreLastWin32Error () returned 0x9dcfeb4000 [0163.384] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x9dd00fdaa0 | out: pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x9dd00fdaa0) returned 1 [0163.384] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x8) returned 0x23f3f4516c0 [0163.384] RtlRestoreLastWin32Error () returned 0x9dcfeb4000 [0163.384] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x23f3f4516c0, pcchLanguagesBuffer=0x9dd00fdaa0 | out: pulNumLanguages=0x9dd00fdba8, pwszLanguagesBuffer=0x23f3f4516c0, pcchLanguagesBuffer=0x9dd00fdaa0) returned 1 [0163.384] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x8) returned 0x23f3f4513f0 [0163.384] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f4516c0) returned 1 [0163.384] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x14) returned 0x23f3e9d5820 [0163.384] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x23f3e9d5820, pulNumLanguages=0x9dd00fdba8 | out: pulNumLanguages=0x9dd00fdba8) returned 1 [0163.384] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3e9d5820) returned 1 [0163.387] malloc (_Size=0x600) returned 0x23f3f307160 [0163.387] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0x9dd00fd288 | out: Buffer=0x0, ReturnedLength=0x9dd00fd288) returned 0 [0163.387] GetLastError () returned 0x7a [0163.387] malloc (_Size=0x250) returned 0x23f3f306d60 [0163.387] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x23f3f306d60, ReturnedLength=0x9dd00fd288 | out: Buffer=0x23f3f306d60, ReturnedLength=0x9dd00fd288) returned 1 [0163.387] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0163.387] GetMaximumProcessorGroupCount () returned 0x1 [0163.387] malloc (_Size=0x40) returned 0x23f3f3056e0 [0163.387] malloc (_Size=0x40) returned 0x23f3f305dc0 [0163.387] malloc (_Size=0x8) returned 0x23f3f306cf0 [0163.387] memcpy (in: _Dst=0x23f3f3056e0, _Src=0x23f3f306d80, _Size=0x10 | out: _Dst=0x23f3f3056e0) returned 0x23f3f3056e0 [0163.388] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0163.388] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0x9dd00fd280, InputBufferLength=0x2, OutputBuffer=0x23f3f307160, OutputBufferLength=0x60 | out: OutputBuffer=0x23f3f307160) returned 0x0 [0163.388] _vsnwprintf (in: _Buffer=0x9dd00fd120, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x9dd00fca18 | out: _Buffer="CPU0") returned 4 [0163.388] GetCurrentThread () returned 0xfffffffffffffffe [0163.388] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x9dd00fc970, PreviousGroupAffinity=0x9dd00fc980 | out: PreviousGroupAffinity=0x9dd00fc980) returned 1 [0163.388] GetSystemInfo (in: lpSystemInfo=0x9dd00fcab0 | out: lpSystemInfo=0x9dd00fcab0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0163.388] mbstowcs (in: _Dest=0x9dd00fcd38, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0163.389] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0163.390] mbstowcs (in: _Dest=0x9dd00fcba8, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0163.390] GetCurrentThread () returned 0xfffffffffffffffe [0163.390] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x9dd00fc980, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0163.394] LoadStringW (in: hInstance=0x7fffd48b0000, uID=0x2c, lpBuffer=0x9dd00fc780, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0163.442] malloc (_Size=0x35140) returned 0x23f3f32a1c0 [0163.449] _wtoi (_String="238") returned 238 [0163.449] _wtoi (_String="6") returned 6 [0163.449] _itow (in: _Dest=0x0, _Radix=-804270000 | out: _Dest=0x0) returned="0" [0163.449] _itow (in: _Dest=0xee, _Radix=-804271712 | out: _Dest=0xee) returned="238" [0163.449] malloc (_Size=0x4000) returned 0x23f3f35f310 [0163.449] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0x23f3f35f310, lpcbData=0x9dd00fc974*=0x4000 | out: lpType=0x0, lpData=0x23f3f35f310*=0x50, lpcbData=0x9dd00fc974*=0x600) returned 0x0 [0163.450] free (_Block=0x23f3f35f310) [0163.450] Sleep (dwMilliseconds=0x3e8) [0164.460] _itow (in: _Dest=0xee, _Radix=-804271712 | out: _Dest=0xee) returned="238" [0164.460] malloc (_Size=0x4000) returned 0x23f3f35f310 [0164.460] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0x23f3f35f310, lpcbData=0x9dd00fc974*=0x4000 | out: lpType=0x0, lpData=0x23f3f35f310*=0x50, lpcbData=0x9dd00fc974*=0x600) returned 0x0 [0164.464] free (_Block=0x23f3f35f310) [0164.467] free (_Block=0x23f3f32a1c0) [0164.473] _vsnwprintf (in: _Buffer=0x9dd00fd050, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0x9dd00fca18 | out: _Buffer="0F8BFBFF00050654") returned 16 [0164.475] lstrlenW (lpString=" 0") returned 2 [0164.479] lstrlenW (lpString="Intel(R) Xeon(R) Gold 6126 CPU @ 2.60GHz") returned 40 [0164.480] lstrlenW (lpString="") returned 0 [0164.481] lstrlenW (lpString="") returned 0 [0164.481] lstrlenW (lpString="") returned 0 [0164.484] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1 [0164.485] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1 [0164.486] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0164.486] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0164.486] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0164.486] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0164.486] _vsnwprintf (in: _Buffer=0x9dd00fd310, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x9dd00fd258 | out: _Buffer="CPU0") returned 4 [0164.489] free (_Block=0x23f3f306cf0) [0164.490] free (_Block=0x23f3f305dc0) [0164.490] free (_Block=0x23f3f3056e0) [0164.491] free (_Block=0x23f3f306d60) [0164.491] free (_Block=0x23f3f307160) [0164.502] RtlAllocateHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, Size=0x4) returned 0x23f3f451570 [0164.503] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x23f3f451570, pulNumLanguages=0x9dd00fdc50 | out: pulNumLanguages=0x9dd00fdc50) returned 1 [0164.503] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f451570) returned 1 [0164.503] RtlFreeHeap (HeapHandle=0x23f3e9a0000, Flags=0x0, BaseAddress=0x23f3f4513f0) returned 1 Thread: id = 118 os_tid = 0x11d8 Thread: id = 119 os_tid = 0x11c8 Thread: id = 157 os_tid = 0x13b8 Process: id = "5" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x6e9f6000" os_pid = "0xb00" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x274" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xe], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cca2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 964 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 965 start_va = 0x1f77800000 end_va = 0x1f779fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001f77800000" filename = "" Region: id = 966 start_va = 0x1f77a00000 end_va = 0x1f77a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001f77a00000" filename = "" Region: id = 967 start_va = 0x1f77b00000 end_va = 0x1f77b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001f77b00000" filename = "" Region: id = 968 start_va = 0x1f77b80000 end_va = 0x1f77bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001f77b80000" filename = "" Region: id = 969 start_va = 0x1f77c00000 end_va = 0x1f77c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001f77c00000" filename = "" Region: id = 970 start_va = 0x1f77c80000 end_va = 0x1f77cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001f77c80000" filename = "" Region: id = 971 start_va = 0x1f77d00000 end_va = 0x1f77d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001f77d00000" filename = "" Region: id = 972 start_va = 0x1f77d80000 end_va = 0x1f77dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001f77d80000" filename = "" Region: id = 973 start_va = 0x1f77e00000 end_va = 0x1f77e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001f77e00000" filename = "" Region: id = 974 start_va = 0x21848350000 end_va = 0x2184835ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021848350000" filename = "" Region: id = 975 start_va = 0x21848360000 end_va = 0x21848366fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021848360000" filename = "" Region: id = 976 start_va = 0x21848370000 end_va = 0x21848384fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021848370000" filename = "" Region: id = 977 start_va = 0x21848390000 end_va = 0x21848393fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021848390000" filename = "" Region: id = 978 start_va = 0x218483a0000 end_va = 0x218483a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000218483a0000" filename = "" Region: id = 979 start_va = 0x218483b0000 end_va = 0x218483b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000218483b0000" filename = "" Region: id = 980 start_va = 0x218483c0000 end_va = 0x218483c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000218483c0000" filename = "" Region: id = 981 start_va = 0x218483d0000 end_va = 0x218483d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000218483d0000" filename = "" Region: id = 982 start_va = 0x218483e0000 end_va = 0x218483e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000218483e0000" filename = "" Region: id = 983 start_va = 0x218483f0000 end_va = 0x218483f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 984 start_va = 0x21848400000 end_va = 0x21848400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021848400000" filename = "" Region: id = 985 start_va = 0x21848410000 end_va = 0x21848410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021848410000" filename = "" Region: id = 986 start_va = 0x21848420000 end_va = 0x21848420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021848420000" filename = "" Region: id = 987 start_va = 0x21848430000 end_va = 0x2184852ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021848430000" filename = "" Region: id = 988 start_va = 0x21848530000 end_va = 0x218485edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 989 start_va = 0x218485f0000 end_va = 0x21848777fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000218485f0000" filename = "" Region: id = 990 start_va = 0x21848780000 end_va = 0x2184878ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021848780000" filename = "" Region: id = 991 start_va = 0x21848790000 end_va = 0x21848ac6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 992 start_va = 0x21848ad0000 end_va = 0x21848c50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021848ad0000" filename = "" Region: id = 993 start_va = 0x21848c60000 end_va = 0x21848d1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021848c60000" filename = "" Region: id = 994 start_va = 0x21848d20000 end_va = 0x21848e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021848d20000" filename = "" Region: id = 995 start_va = 0x21848e20000 end_va = 0x21848e68fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32.dll.mui") Region: id = 996 start_va = 0x21849080000 end_va = 0x2184917ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021849080000" filename = "" Region: id = 997 start_va = 0x21849180000 end_va = 0x2184937ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021849180000" filename = "" Region: id = 998 start_va = 0x21849380000 end_va = 0x2184977ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021849380000" filename = "" Region: id = 999 start_va = 0x21849780000 end_va = 0x21849782fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mofd.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\mofd.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\mofd.dll.mui") Region: id = 1000 start_va = 0x218499a0000 end_va = 0x2184a19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000218499a0000" filename = "" Region: id = 1001 start_va = 0x7df5ff870000 end_va = 0x7ff5ff86ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff870000" filename = "" Region: id = 1002 start_va = 0x7ff70d7f0000 end_va = 0x7ff70d8effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff70d7f0000" filename = "" Region: id = 1003 start_va = 0x7ff70d8f0000 end_va = 0x7ff70d912fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff70d8f0000" filename = "" Region: id = 1004 start_va = 0x7ff70db70000 end_va = 0x7ff70dbeffff monitored = 0 entry_point = 0x7ff70db85f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1005 start_va = 0x7fffd4830000 end_va = 0x7fffd487cfff monitored = 0 entry_point = 0x7fffd483b470 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 1006 start_va = 0x7fffd4880000 end_va = 0x7fffd48a4fff monitored = 1 entry_point = 0x7fffd4895dc0 region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 1007 start_va = 0x7fffd50c0000 end_va = 0x7fffd5100fff monitored = 0 entry_point = 0x7fffd50e8ae0 region_type = mapped_file name = "mofd.dll" filename = "\\Windows\\System32\\wbem\\mofd.dll" (normalized: "c:\\windows\\system32\\wbem\\mofd.dll") Region: id = 1008 start_va = 0x7fffd6f60000 end_va = 0x7fffd6f9cfff monitored = 1 entry_point = 0x7fffd6f6b760 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 1009 start_va = 0x7fffdbca0000 end_va = 0x7fffdbcb5fff monitored = 0 entry_point = 0x7fffdbca55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1010 start_va = 0x7fffdbe20000 end_va = 0x7fffdbe44fff monitored = 0 entry_point = 0x7fffdbe29900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1011 start_va = 0x7fffdbe90000 end_va = 0x7fffdbf85fff monitored = 0 entry_point = 0x7fffdbec9590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1012 start_va = 0x7fffdc1c0000 end_va = 0x7fffdc1d0fff monitored = 0 entry_point = 0x7fffdc1c2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1013 start_va = 0x7fffdf030000 end_va = 0x7fffdf0aefff monitored = 1 entry_point = 0x7fffdf047110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1014 start_va = 0x7fffe8a70000 end_va = 0x7fffe8ad3fff monitored = 0 entry_point = 0x7fffe8a85ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1015 start_va = 0x7fffe8ca0000 end_va = 0x7fffe8cb0fff monitored = 0 entry_point = 0x7fffe8ca3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1016 start_va = 0x7fffeb4e0000 end_va = 0x7fffeb4f3fff monitored = 0 entry_point = 0x7fffeb4e1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1017 start_va = 0x7fffec2b0000 end_va = 0x7fffec2e0fff monitored = 0 entry_point = 0x7fffec2b7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1018 start_va = 0x7fffecc50000 end_va = 0x7fffecc78fff monitored = 0 entry_point = 0x7fffecc64530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1019 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1020 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1021 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1022 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1023 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1024 start_va = 0x7fffede30000 end_va = 0x7fffeded6fff monitored = 0 entry_point = 0x7fffede3b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1025 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1026 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1027 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1028 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1029 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1030 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1031 start_va = 0x7ffff0540000 end_va = 0x7ffff05aafff monitored = 0 entry_point = 0x7ffff05590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1032 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1033 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 120 os_tid = 0x10cc Thread: id = 121 os_tid = 0x10c4 Thread: id = 122 os_tid = 0x10a0 [0152.863] DllCanUnloadNow () returned 0x1 [0152.863] DllCanUnloadNow () returned 0x1 [0272.871] DllCanUnloadNow () returned 0x1 [0272.871] DllCanUnloadNow () returned 0x1 Thread: id = 123 os_tid = 0xcb8 Thread: id = 124 os_tid = 0xcb4 Thread: id = 125 os_tid = 0xbdc Thread: id = 126 os_tid = 0x410 Thread: id = 127 os_tid = 0xb04 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x75dc0000" os_pid = "0x388" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xa], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c65b" [0xc000000f], "LOCAL" [0x7] Region: id = 1128 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1129 start_va = 0x93e6a00000 end_va = 0x93e6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e6a00000" filename = "" Region: id = 1130 start_va = 0x93e6c00000 end_va = 0x93e6c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e6c00000" filename = "" Region: id = 1131 start_va = 0x93e7000000 end_va = 0x93e70fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7000000" filename = "" Region: id = 1132 start_va = 0x93e7100000 end_va = 0x93e717ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7100000" filename = "" Region: id = 1133 start_va = 0x93e7200000 end_va = 0x93e727ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7200000" filename = "" Region: id = 1134 start_va = 0x93e7280000 end_va = 0x93e72fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7280000" filename = "" Region: id = 1135 start_va = 0x93e7300000 end_va = 0x93e737ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7300000" filename = "" Region: id = 1136 start_va = 0x93e7380000 end_va = 0x93e73fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7380000" filename = "" Region: id = 1137 start_va = 0x93e7400000 end_va = 0x93e74fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7400000" filename = "" Region: id = 1138 start_va = 0x93e7500000 end_va = 0x93e75fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7500000" filename = "" Region: id = 1139 start_va = 0x93e7c00000 end_va = 0x93e7cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7c00000" filename = "" Region: id = 1140 start_va = 0x93e7e00000 end_va = 0x93e7e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7e00000" filename = "" Region: id = 1141 start_va = 0x93e7e80000 end_va = 0x93e7f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7e80000" filename = "" Region: id = 1142 start_va = 0x93e7f80000 end_va = 0x93e807ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e7f80000" filename = "" Region: id = 1143 start_va = 0x93e8400000 end_va = 0x93e84fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e8400000" filename = "" Region: id = 1144 start_va = 0x93e8500000 end_va = 0x93e857ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e8500000" filename = "" Region: id = 1145 start_va = 0x93e8580000 end_va = 0x93e85fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e8580000" filename = "" Region: id = 1146 start_va = 0x93e8600000 end_va = 0x93e867ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e8600000" filename = "" Region: id = 1147 start_va = 0x93e8c80000 end_va = 0x93e8d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e8c80000" filename = "" Region: id = 1148 start_va = 0x93e8d80000 end_va = 0x93e8e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e8d80000" filename = "" Region: id = 1149 start_va = 0x93e9400000 end_va = 0x93e94fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9400000" filename = "" Region: id = 1150 start_va = 0x93e9500000 end_va = 0x93e95fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9500000" filename = "" Region: id = 1151 start_va = 0x93e9600000 end_va = 0x93e96fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9600000" filename = "" Region: id = 1152 start_va = 0x93e9800000 end_va = 0x93e98fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9800000" filename = "" Region: id = 1153 start_va = 0x93e9900000 end_va = 0x93e99fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9900000" filename = "" Region: id = 1154 start_va = 0x1e6d0680000 end_va = 0x1e6d068ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d0680000" filename = "" Region: id = 1155 start_va = 0x1e6d0690000 end_va = 0x1e6d0690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 1156 start_va = 0x1e6d06a0000 end_va = 0x1e6d06b4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d06a0000" filename = "" Region: id = 1157 start_va = 0x1e6d06c0000 end_va = 0x1e6d06c3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d06c0000" filename = "" Region: id = 1158 start_va = 0x1e6d06d0000 end_va = 0x1e6d06d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d06d0000" filename = "" Region: id = 1159 start_va = 0x1e6d06e0000 end_va = 0x1e6d06e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d06e0000" filename = "" Region: id = 1160 start_va = 0x1e6d06f0000 end_va = 0x1e6d07adfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1161 start_va = 0x1e6d07b0000 end_va = 0x1e6d07b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d07b0000" filename = "" Region: id = 1162 start_va = 0x1e6d07c0000 end_va = 0x1e6d07c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d07c0000" filename = "" Region: id = 1163 start_va = 0x1e6d07d0000 end_va = 0x1e6d07d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d07d0000" filename = "" Region: id = 1164 start_va = 0x1e6d07e0000 end_va = 0x1e6d07fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d07e0000" filename = "" Region: id = 1165 start_va = 0x1e6d0800000 end_va = 0x1e6d08fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d0800000" filename = "" Region: id = 1166 start_va = 0x1e6d0900000 end_va = 0x1e6d0963fff monitored = 0 entry_point = 0x1e6d0915ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1167 start_va = 0x1e6d0970000 end_va = 0x1e6d098ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d0970000" filename = "" Region: id = 1168 start_va = 0x1e6d0990000 end_va = 0x1e6d0990fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d0990000" filename = "" Region: id = 1169 start_va = 0x1e6d09a0000 end_va = 0x1e6d09a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d09a0000" filename = "" Region: id = 1170 start_va = 0x1e6d09b0000 end_va = 0x1e6d09cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d09b0000" filename = "" Region: id = 1171 start_va = 0x1e6d09d0000 end_va = 0x1e6d09d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d09d0000" filename = "" Region: id = 1172 start_va = 0x1e6d09e0000 end_va = 0x1e6d09e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d09e0000" filename = "" Region: id = 1173 start_va = 0x1e6d09f0000 end_va = 0x1e6d09f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d09f0000" filename = "" Region: id = 1174 start_va = 0x1e6d0a00000 end_va = 0x1e6d0afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d0a00000" filename = "" Region: id = 1175 start_va = 0x1e6d0b00000 end_va = 0x1e6d0c87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d0b00000" filename = "" Region: id = 1176 start_va = 0x1e6d0c90000 end_va = 0x1e6d0e10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d0c90000" filename = "" Region: id = 1177 start_va = 0x1e6d0e20000 end_va = 0x1e6d0edffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d0e20000" filename = "" Region: id = 1178 start_va = 0x1e6d0ee0000 end_va = 0x1e6d0ee0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d0ee0000" filename = "" Region: id = 1179 start_va = 0x1e6d0ef0000 end_va = 0x1e6d0ef0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e6d0ef0000" filename = "" Region: id = 1180 start_va = 0x1e6d0f00000 end_va = 0x1e6d0f00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d0f00000" filename = "" Region: id = 1181 start_va = 0x1e6d0fc0000 end_va = 0x1e6d0fc6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d0fc0000" filename = "" Region: id = 1182 start_va = 0x1e6d1000000 end_va = 0x1e6d10fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1000000" filename = "" Region: id = 1183 start_va = 0x1e6d1190000 end_va = 0x1e6d128ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1190000" filename = "" Region: id = 1184 start_va = 0x1e6d12b0000 end_va = 0x1e6d12b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d12b0000" filename = "" Region: id = 1185 start_va = 0x1e6d1300000 end_va = 0x1e6d13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1300000" filename = "" Region: id = 1186 start_va = 0x1e6d1400000 end_va = 0x1e6d14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1400000" filename = "" Region: id = 1187 start_va = 0x1e6d1500000 end_va = 0x1e6d15fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1500000" filename = "" Region: id = 1188 start_va = 0x1e6d1600000 end_va = 0x1e6d16fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1600000" filename = "" Region: id = 1189 start_va = 0x1e6d1700000 end_va = 0x1e6d1a36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1190 start_va = 0x1e6d1a40000 end_va = 0x1e6d1b1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1191 start_va = 0x1e6d1c00000 end_va = 0x1e6d1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1c00000" filename = "" Region: id = 1192 start_va = 0x1e6d1d00000 end_va = 0x1e6d1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1d00000" filename = "" Region: id = 1193 start_va = 0x1e6d1e00000 end_va = 0x1e6d1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1e00000" filename = "" Region: id = 1194 start_va = 0x1e6d1f00000 end_va = 0x1e6d1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d1f00000" filename = "" Region: id = 1195 start_va = 0x1e6d2000000 end_va = 0x1e6d20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d2000000" filename = "" Region: id = 1196 start_va = 0x1e6d2100000 end_va = 0x1e6d21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d2100000" filename = "" Region: id = 1197 start_va = 0x1e6d2200000 end_va = 0x1e6d22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d2200000" filename = "" Region: id = 1198 start_va = 0x1e6d2300000 end_va = 0x1e6d23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d2300000" filename = "" Region: id = 1199 start_va = 0x7df5ff1c0000 end_va = 0x7ff5ff1bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff1c0000" filename = "" Region: id = 1200 start_va = 0x7ff65ab90000 end_va = 0x7ff65ac8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65ab90000" filename = "" Region: id = 1201 start_va = 0x7ff65ac90000 end_va = 0x7ff65acb2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65ac90000" filename = "" Region: id = 1202 start_va = 0x7ff65b180000 end_va = 0x7ff65b18cfff monitored = 0 entry_point = 0x7ff65b183980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1203 start_va = 0x7fffd3ff0000 end_va = 0x7fffd4022fff monitored = 0 entry_point = 0x7fffd3ffae20 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 1204 start_va = 0x7fffd91e0000 end_va = 0x7fffd9397fff monitored = 0 entry_point = 0x7fffd91e5550 region_type = mapped_file name = "wmalfxgfxdsp.dll" filename = "\\Windows\\System32\\WMALFXGFXDSP.dll" (normalized: "c:\\windows\\system32\\wmalfxgfxdsp.dll") Region: id = 1205 start_va = 0x7fffda8d0000 end_va = 0x7fffda957fff monitored = 0 entry_point = 0x7fffda8e4510 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 1206 start_va = 0x7fffdbe90000 end_va = 0x7fffdbf85fff monitored = 0 entry_point = 0x7fffdbec9590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1207 start_va = 0x7fffdc1c0000 end_va = 0x7fffdc1d0fff monitored = 0 entry_point = 0x7fffdc1c2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1208 start_va = 0x7fffdf030000 end_va = 0x7fffdf0aefff monitored = 0 entry_point = 0x7fffdf047110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1209 start_va = 0x7fffe4830000 end_va = 0x7fffe485afff monitored = 0 entry_point = 0x7fffe483c3c0 region_type = mapped_file name = "rtworkq.dll" filename = "\\Windows\\System32\\RTWorkQ.dll" (normalized: "c:\\windows\\system32\\rtworkq.dll") Region: id = 1210 start_va = 0x7fffe4860000 end_va = 0x7fffe496cfff monitored = 0 entry_point = 0x7fffe488f420 region_type = mapped_file name = "mfplat.dll" filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll") Region: id = 1211 start_va = 0x7fffe5570000 end_va = 0x7fffe557dfff monitored = 0 entry_point = 0x7fffe5572e50 region_type = mapped_file name = "cmintegrator.dll" filename = "\\Windows\\System32\\cmintegrator.dll" (normalized: "c:\\windows\\system32\\cmintegrator.dll") Region: id = 1212 start_va = 0x7fffe5580000 end_va = 0x7fffe55b7fff monitored = 0 entry_point = 0x7fffe55868f0 region_type = mapped_file name = "wcmcsp.dll" filename = "\\Windows\\System32\\wcmcsp.dll" (normalized: "c:\\windows\\system32\\wcmcsp.dll") Region: id = 1213 start_va = 0x7fffe5660000 end_va = 0x7fffe56f8fff monitored = 0 entry_point = 0x7fffe567a090 region_type = mapped_file name = "wcmsvc.dll" filename = "\\Windows\\System32\\wcmsvc.dll" (normalized: "c:\\windows\\system32\\wcmsvc.dll") Region: id = 1214 start_va = 0x7fffe5980000 end_va = 0x7fffe5a8afff monitored = 0 entry_point = 0x7fffe59c2610 region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 1215 start_va = 0x7fffe5bb0000 end_va = 0x7fffe5bc9fff monitored = 0 entry_point = 0x7fffe5bb2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1216 start_va = 0x7fffe5bd0000 end_va = 0x7fffe5be5fff monitored = 0 entry_point = 0x7fffe5bd19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1217 start_va = 0x7fffe5cb0000 end_va = 0x7fffe5d1ffff monitored = 0 entry_point = 0x7fffe5cd2960 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 1218 start_va = 0x7fffe5d70000 end_va = 0x7fffe5da7fff monitored = 0 entry_point = 0x7fffe5d88cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1219 start_va = 0x7fffe6390000 end_va = 0x7fffe639afff monitored = 0 entry_point = 0x7fffe6391d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1220 start_va = 0x7fffe63a0000 end_va = 0x7fffe63e7fff monitored = 0 entry_point = 0x7fffe63aa1e0 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 1221 start_va = 0x7fffe6bf0000 end_va = 0x7fffe6c4cfff monitored = 0 entry_point = 0x7fffe6c02bf0 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 1222 start_va = 0x7fffe6ea0000 end_va = 0x7fffe6fd5fff monitored = 0 entry_point = 0x7fffe6ecf350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1223 start_va = 0x7fffe8ae0000 end_va = 0x7fffe8c90fff monitored = 0 entry_point = 0x7fffe8b33690 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 1224 start_va = 0x7fffe8ca0000 end_va = 0x7fffe8cb0fff monitored = 0 entry_point = 0x7fffe8ca3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1225 start_va = 0x7fffe91c0000 end_va = 0x7fffe91d7fff monitored = 0 entry_point = 0x7fffe91c5910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1226 start_va = 0x7fffe9320000 end_va = 0x7fffe93e7fff monitored = 0 entry_point = 0x7fffe93613f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1227 start_va = 0x7fffe9ea0000 end_va = 0x7fffe9ee9fff monitored = 0 entry_point = 0x7fffe9eaac30 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 1228 start_va = 0x7fffea050000 end_va = 0x7fffea058fff monitored = 0 entry_point = 0x7fffea0519a0 region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 1229 start_va = 0x7fffea060000 end_va = 0x7fffea06afff monitored = 0 entry_point = 0x7fffea061cd0 region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 1230 start_va = 0x7fffeb310000 end_va = 0x7fffeb495fff monitored = 0 entry_point = 0x7fffeb35d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1231 start_va = 0x7fffeb4e0000 end_va = 0x7fffeb4f3fff monitored = 0 entry_point = 0x7fffeb4e1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1232 start_va = 0x7fffeb500000 end_va = 0x7fffeb512fff monitored = 0 entry_point = 0x7fffeb502760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1233 start_va = 0x7fffeb7e0000 end_va = 0x7fffeb806fff monitored = 0 entry_point = 0x7fffeb7e7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1234 start_va = 0x7fffeb830000 end_va = 0x7fffeb8d9fff monitored = 0 entry_point = 0x7fffeb857910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1235 start_va = 0x7fffeb8e0000 end_va = 0x7fffeb9dffff monitored = 0 entry_point = 0x7fffeb920f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1236 start_va = 0x7fffebc40000 end_va = 0x7fffebc71fff monitored = 0 entry_point = 0x7fffebc52340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1237 start_va = 0x7fffebdc0000 end_va = 0x7fffebde3fff monitored = 0 entry_point = 0x7fffebdc3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1238 start_va = 0x7fffebf60000 end_va = 0x7fffec053fff monitored = 0 entry_point = 0x7fffebf6a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1239 start_va = 0x7fffec1d0000 end_va = 0x7fffec1dbfff monitored = 0 entry_point = 0x7fffec1d27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1240 start_va = 0x7fffec2b0000 end_va = 0x7fffec2e0fff monitored = 0 entry_point = 0x7fffec2b7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1241 start_va = 0x7fffec520000 end_va = 0x7fffec53efff monitored = 0 entry_point = 0x7fffec525d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1242 start_va = 0x7fffec690000 end_va = 0x7fffec6ebfff monitored = 0 entry_point = 0x7fffec6a6f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1243 start_va = 0x7fffec860000 end_va = 0x7fffec86afff monitored = 0 entry_point = 0x7fffec8619a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1244 start_va = 0x7fffec960000 end_va = 0x7fffec9b5fff monitored = 0 entry_point = 0x7fffec970bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1245 start_va = 0x7fffecaa0000 end_va = 0x7fffecaccfff monitored = 0 entry_point = 0x7fffecab9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1246 start_va = 0x7fffecc50000 end_va = 0x7fffecc78fff monitored = 0 entry_point = 0x7fffecc64530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1247 start_va = 0x7fffecdc0000 end_va = 0x7fffecdd3fff monitored = 0 entry_point = 0x7fffecdc52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1248 start_va = 0x7fffecde0000 end_va = 0x7fffece2afff monitored = 0 entry_point = 0x7fffecde35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1249 start_va = 0x7fffece30000 end_va = 0x7fffece3ffff monitored = 0 entry_point = 0x7fffece356e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1250 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1251 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1252 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1253 start_va = 0x7fffed8f0000 end_va = 0x7fffed932fff monitored = 0 entry_point = 0x7fffed904b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1254 start_va = 0x7fffed940000 end_va = 0x7fffedb06fff monitored = 0 entry_point = 0x7fffed99db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1255 start_va = 0x7fffedb10000 end_va = 0x7fffedb95fff monitored = 0 entry_point = 0x7fffedb1d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1256 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1257 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1258 start_va = 0x7fffede30000 end_va = 0x7fffeded6fff monitored = 0 entry_point = 0x7fffede3b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1259 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1260 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1261 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1262 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1263 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1264 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1265 start_va = 0x7ffff0530000 end_va = 0x7ffff0537fff monitored = 0 entry_point = 0x7ffff0531ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1266 start_va = 0x7ffff0540000 end_va = 0x7ffff05aafff monitored = 0 entry_point = 0x7ffff05590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1267 start_va = 0x7ffff05b0000 end_va = 0x7ffff06f2fff monitored = 0 entry_point = 0x7ffff05d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1268 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1269 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2528 start_va = 0x1e6d2400000 end_va = 0x1e6d2565fff monitored = 0 entry_point = 0x1e6d24479f0 region_type = mapped_file name = "diagperf.dll" filename = "\\Windows\\System32\\diagperf.dll" (normalized: "c:\\windows\\system32\\diagperf.dll") Region: id = 2529 start_va = 0x1e6d1b20000 end_va = 0x1e6d1bf9fff monitored = 0 entry_point = 0x1e6d1b53c00 region_type = mapped_file name = "wpncore.dll" filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll") Region: id = 2530 start_va = 0x1e6d2400000 end_va = 0x1e6d25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d2400000" filename = "" Region: id = 2531 start_va = 0x1e6d2400000 end_va = 0x1e6d24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e6d2400000" filename = "" Region: id = 2536 start_va = 0x1e6d0f10000 end_va = 0x1e6d0f19fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "aeevts.dll" filename = "\\Windows\\System32\\aeevts.dll" (normalized: "c:\\windows\\system32\\aeevts.dll") Region: id = 2543 start_va = 0x93e9a00000 end_va = 0x93e9afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9a00000" filename = "" Region: id = 2544 start_va = 0x93e9b00000 end_va = 0x93e9bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9b00000" filename = "" Region: id = 2557 start_va = 0x93e9c00000 end_va = 0x93e9cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9c00000" filename = "" Region: id = 2558 start_va = 0x93e9d00000 end_va = 0x93e9dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000093e9d00000" filename = "" Thread: id = 132 os_tid = 0x11a8 Thread: id = 133 os_tid = 0x1178 Thread: id = 134 os_tid = 0xc7c Thread: id = 135 os_tid = 0x10b0 Thread: id = 136 os_tid = 0xc70 Thread: id = 137 os_tid = 0x940 Thread: id = 138 os_tid = 0x4e0 Thread: id = 139 os_tid = 0x184 Thread: id = 140 os_tid = 0x40c Thread: id = 141 os_tid = 0xb84 Thread: id = 142 os_tid = 0xbf8 Thread: id = 143 os_tid = 0x4b0 Thread: id = 144 os_tid = 0x4ac Thread: id = 145 os_tid = 0x4a8 Thread: id = 146 os_tid = 0x48c Thread: id = 147 os_tid = 0x414 Thread: id = 148 os_tid = 0x3d0 Thread: id = 149 os_tid = 0x344 Thread: id = 150 os_tid = 0x2f4 Thread: id = 151 os_tid = 0x30c Thread: id = 152 os_tid = 0x2ac Thread: id = 153 os_tid = 0x180 Thread: id = 154 os_tid = 0x15c Thread: id = 155 os_tid = 0x38c Thread: id = 206 os_tid = 0xfa4 Thread: id = 207 os_tid = 0xfa8 Thread: id = 220 os_tid = 0xc64 Thread: id = 221 os_tid = 0x13f0 Process: id = "7" image_name = "werfault.exe" filename = "c:\\windows\\syswow64\\werfault.exe" page_root = "0x49469000" os_pid = "0x13f8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x12ec" cmd_line = "C:\\Windows\\SysWOW64\\WerFault.exe -u -p 4844 -s 1816" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2053 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2054 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2055 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2056 start_va = 0x90000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2057 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2058 start_va = 0xe0000 end_va = 0xe1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2059 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2060 start_va = 0x160000 end_va = 0x1a2fff monitored = 0 entry_point = 0x180f50 region_type = mapped_file name = "werfault.exe" filename = "\\Windows\\SysWOW64\\WerFault.exe" (normalized: "c:\\windows\\syswow64\\werfault.exe") Region: id = 2061 start_va = 0x1b0000 end_va = 0x41affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 2062 start_va = 0x41b0000 end_va = 0x41b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041b0000" filename = "" Region: id = 2063 start_va = 0x4200000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 2064 start_va = 0x77220000 end_va = 0x7739afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2065 start_va = 0x7eb20000 end_va = 0x7eb42fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eb20000" filename = "" Region: id = 2066 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2067 start_va = 0x7fff0000 end_va = 0x7dfff079ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2068 start_va = 0x7dfff07a0000 end_va = 0x7ffff079ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfff07a0000" filename = "" Region: id = 2069 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2070 start_va = 0x7ffff0961000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffff0961000" filename = "" Region: id = 2071 start_va = 0x4400000 end_va = 0x449ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 2072 start_va = 0x656f0000 end_va = 0x6573ffff monitored = 0 entry_point = 0x65708180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2073 start_va = 0x65670000 end_va = 0x656e9fff monitored = 0 entry_point = 0x65683290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2074 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2075 start_va = 0x65740000 end_va = 0x65747fff monitored = 0 entry_point = 0x657417c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2076 start_va = 0x44a0000 end_va = 0x478ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 2077 start_va = 0x770a0000 end_va = 0x7717ffff monitored = 0 entry_point = 0x770b3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2078 start_va = 0x74920000 end_va = 0x74a9dfff monitored = 0 entry_point = 0x749d1b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2079 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2080 start_va = 0x7ea20000 end_va = 0x7eb1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ea20000" filename = "" Region: id = 2081 start_va = 0x44a0000 end_va = 0x455dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2082 start_va = 0x4690000 end_va = 0x478ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004690000" filename = "" Region: id = 2083 start_va = 0x75640000 end_va = 0x756fdfff monitored = 0 entry_point = 0x75675630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2084 start_va = 0x100000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2085 start_va = 0x41b0000 end_va = 0x41effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041b0000" filename = "" Region: id = 2086 start_va = 0x77180000 end_va = 0x7720cfff monitored = 0 entry_point = 0x771c9b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 2087 start_va = 0x75420000 end_va = 0x755dcfff monitored = 0 entry_point = 0x75502a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 2088 start_va = 0x75ad0000 end_va = 0x75b7cfff monitored = 0 entry_point = 0x75ae4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2089 start_va = 0x73f50000 end_va = 0x73f6dfff monitored = 0 entry_point = 0x73f5b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2090 start_va = 0x41f0000 end_va = 0x41f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041f0000" filename = "" Region: id = 2091 start_va = 0x73f40000 end_va = 0x73f49fff monitored = 0 entry_point = 0x73f42a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2092 start_va = 0x755e0000 end_va = 0x75637fff monitored = 0 entry_point = 0x756225c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 2093 start_va = 0x75900000 end_va = 0x75943fff monitored = 0 entry_point = 0x75919d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2094 start_va = 0x75a50000 end_va = 0x75acafff monitored = 0 entry_point = 0x75a6e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2095 start_va = 0x6af90000 end_va = 0x6b016fff monitored = 0 entry_point = 0x6affdbc0 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\SysWOW64\\wer.dll" (normalized: "c:\\windows\\syswow64\\wer.dll") Region: id = 2096 start_va = 0x6af60000 end_va = 0x6af81fff monitored = 0 entry_point = 0x6af691f0 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 2097 start_va = 0x758c0000 end_va = 0x758f6fff monitored = 0 entry_point = 0x758c3b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 2098 start_va = 0x71590000 end_va = 0x715aafff monitored = 0 entry_point = 0x71599050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 2099 start_va = 0x6af00000 end_va = 0x6af53fff monitored = 0 entry_point = 0x6af310d0 region_type = mapped_file name = "faultrep.dll" filename = "\\Windows\\SysWOW64\\Faultrep.dll" (normalized: "c:\\windows\\syswow64\\faultrep.dll") Region: id = 2100 start_va = 0x6adc0000 end_va = 0x6aefefff monitored = 0 entry_point = 0x6aded880 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2101 start_va = 0x6ad90000 end_va = 0x6adb0fff monitored = 0 entry_point = 0x6adaa910 region_type = mapped_file name = "dbgcore.dll" filename = "\\Windows\\SysWOW64\\dbgcore.dll" (normalized: "c:\\windows\\syswow64\\dbgcore.dll") Region: id = 2102 start_va = 0x4400000 end_va = 0x440ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 2103 start_va = 0x4490000 end_va = 0x449ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 2104 start_va = 0x4790000 end_va = 0x491ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004790000" filename = "" Region: id = 2105 start_va = 0x4410000 end_va = 0x4413fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004410000" filename = "" Region: id = 2106 start_va = 0x74c10000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74c21cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2107 start_va = 0x74250000 end_va = 0x7439efff monitored = 0 entry_point = 0x74306820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2108 start_va = 0x4420000 end_va = 0x4449fff monitored = 0 entry_point = 0x4425680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2109 start_va = 0x4920000 end_va = 0x4aa7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004920000" filename = "" Region: id = 2110 start_va = 0x757e0000 end_va = 0x7580afff monitored = 0 entry_point = 0x757e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2111 start_va = 0x4ab0000 end_va = 0x4c30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ab0000" filename = "" Region: id = 2112 start_va = 0x4c40000 end_va = 0x603ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004c40000" filename = "" Region: id = 2113 start_va = 0x4420000 end_va = 0x4423fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "werfault.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\WerFault.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\werfault.exe.mui") Region: id = 2114 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2115 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2116 start_va = 0x73e20000 end_va = 0x73e94fff monitored = 0 entry_point = 0x73e59a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2117 start_va = 0x4560000 end_va = 0x464ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004560000" filename = "" Region: id = 2119 start_va = 0x4430000 end_va = 0x4430fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004430000" filename = "" Region: id = 2120 start_va = 0x4440000 end_va = 0x4440fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004440000" filename = "" Region: id = 2121 start_va = 0x4450000 end_va = 0x4450fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 2122 start_va = 0x75410000 end_va = 0x7541bfff monitored = 0 entry_point = 0x75413930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 2123 start_va = 0x4450000 end_va = 0x4450fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 2124 start_va = 0x6040000 end_va = 0x683ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006040000" filename = "" Region: id = 2125 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2126 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2127 start_va = 0x6040000 end_va = 0x6376fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2128 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2129 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2130 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2131 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2132 start_va = 0x4560000 end_va = 0x463ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2133 start_va = 0x4640000 end_va = 0x464ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004640000" filename = "" Region: id = 2134 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2135 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2136 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2137 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2138 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2139 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2140 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2141 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2142 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2143 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2144 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2145 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2146 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2147 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2148 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2149 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2150 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2151 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2152 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2153 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2154 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2155 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2156 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2157 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2158 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2159 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2160 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2161 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2162 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2163 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2164 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2165 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2166 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2167 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2168 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2169 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2170 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2171 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2172 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2173 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2174 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2175 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2176 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2177 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2178 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2179 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2180 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2181 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2182 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2183 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2184 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2185 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2186 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2187 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2188 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2189 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2190 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2191 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2192 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2193 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2194 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2195 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2196 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2197 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2198 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2199 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2200 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2201 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2202 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2203 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2204 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2205 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2206 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2207 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2208 start_va = 0x4450000 end_va = 0x4464fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004450000" filename = "" Region: id = 2209 start_va = 0x4450000 end_va = 0x448ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 2210 start_va = 0x4650000 end_va = 0x468ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 2211 start_va = 0x4790000 end_va = 0x480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004790000" filename = "" Region: id = 2212 start_va = 0x4910000 end_va = 0x491ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004910000" filename = "" Region: id = 2213 start_va = 0x4450000 end_va = 0x4451fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "faultrep.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\faultrep.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\faultrep.dll.mui") Region: id = 2214 start_va = 0x4460000 end_va = 0x4460fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004460000" filename = "" Region: id = 2215 start_va = 0x6ac40000 end_va = 0x6ad8cfff monitored = 1 entry_point = 0x6ad2bf40 region_type = mapped_file name = "mscordacwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscordacwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscordacwks.dll") Region: id = 2216 start_va = 0x4650000 end_va = 0x468ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 2217 start_va = 0x4650000 end_va = 0x468ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 2218 start_va = 0x4650000 end_va = 0x468ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 2219 start_va = 0x4650000 end_va = 0x468ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 2220 start_va = 0x4650000 end_va = 0x468ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 2221 start_va = 0x4650000 end_va = 0x468ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 2222 start_va = 0x4650000 end_va = 0x468ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 2223 start_va = 0x4650000 end_va = 0x468ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 2224 start_va = 0x4650000 end_va = 0x468ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 2225 start_va = 0x4650000 end_va = 0x468ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 2226 start_va = 0x4460000 end_va = 0x4462fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wer.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\wer.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wer.dll.mui") Region: id = 2227 start_va = 0x6a820000 end_va = 0x6ac3dfff monitored = 0 entry_point = 0x6a91ee80 region_type = mapped_file name = "dbgeng.dll" filename = "\\Windows\\SysWOW64\\dbgeng.dll" (normalized: "c:\\windows\\syswow64\\dbgeng.dll") Region: id = 2228 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2229 start_va = 0x6fb20000 end_va = 0x6fb4cfff monitored = 0 entry_point = 0x6fb32b00 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\SysWOW64\\xmllite.dll" (normalized: "c:\\windows\\syswow64\\xmllite.dll") Region: id = 2230 start_va = 0x6a7b0000 end_va = 0x6a81ffff monitored = 0 entry_point = 0x6a804b90 region_type = mapped_file name = "dbgmodel.dll" filename = "\\Windows\\SysWOW64\\DbgModel.dll" (normalized: "c:\\windows\\syswow64\\dbgmodel.dll") Region: id = 2231 start_va = 0x4810000 end_va = 0x484ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004810000" filename = "" Region: id = 2232 start_va = 0x6380000 end_va = 0x6469fff monitored = 0 entry_point = 0x63bd650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2233 start_va = 0x4850000 end_va = 0x488ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004850000" filename = "" Region: id = 2234 start_va = 0x6fe40000 end_va = 0x6fe49fff monitored = 0 entry_point = 0x6fe43200 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2235 start_va = 0x74e30000 end_va = 0x74e74fff monitored = 0 entry_point = 0x74e4de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2236 start_va = 0x6fb10000 end_va = 0x6fb17fff monitored = 0 entry_point = 0x6fb117b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2237 start_va = 0x6380000 end_va = 0x647ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 2238 start_va = 0x75950000 end_va = 0x75a3afff monitored = 0 entry_point = 0x7598d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2239 start_va = 0x4470000 end_va = 0x4471fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2240 start_va = 0x4470000 end_va = 0x4473fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2241 start_va = 0x4470000 end_va = 0x4475fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2242 start_va = 0x4470000 end_va = 0x4477fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2243 start_va = 0x6480000 end_va = 0x657ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006480000" filename = "" Region: id = 2244 start_va = 0x4470000 end_va = 0x4479fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2245 start_va = 0x4470000 end_va = 0x447bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2246 start_va = 0x4470000 end_va = 0x447dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2247 start_va = 0x4470000 end_va = 0x447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2248 start_va = 0x4470000 end_va = 0x4481fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2249 start_va = 0x4470000 end_va = 0x4483fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2250 start_va = 0x4470000 end_va = 0x4485fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2251 start_va = 0x4470000 end_va = 0x4487fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2252 start_va = 0x4470000 end_va = 0x4489fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2253 start_va = 0x4470000 end_va = 0x448bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2254 start_va = 0x6580000 end_va = 0x667ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006580000" filename = "" Region: id = 2255 start_va = 0x6680000 end_va = 0x687ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006680000" filename = "" Region: id = 2256 start_va = 0x6880000 end_va = 0x6948fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006880000" filename = "" Region: id = 2257 start_va = 0x6950000 end_va = 0x69fbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006950000" filename = "" Region: id = 2258 start_va = 0x6a00000 end_va = 0x6ab0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 2259 start_va = 0x4470000 end_va = 0x4470fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 2260 start_va = 0x4480000 end_va = 0x4483fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 2261 start_va = 0x6880000 end_va = 0x707ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006880000" filename = "" Region: id = 2262 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2263 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2264 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2265 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2266 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2267 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2268 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2269 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2270 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2271 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2272 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2273 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2274 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2275 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2276 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2277 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2278 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2279 start_va = 0x6880000 end_va = 0x697ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006880000" filename = "" Region: id = 2280 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2281 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2282 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2283 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2284 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2285 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2286 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2287 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2288 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2289 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2290 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2291 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2292 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2293 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2294 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2295 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2296 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2297 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2298 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2299 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2300 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2301 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2302 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2303 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2304 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2305 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2306 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2307 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2308 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2309 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2310 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2311 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2312 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2313 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2314 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2315 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2316 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2317 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2318 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2319 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2320 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2321 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2322 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2323 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2324 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2325 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2326 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2327 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2328 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2329 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2330 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2331 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2332 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2333 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2334 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2335 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2336 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2337 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2338 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2339 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2341 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2342 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2343 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2344 start_va = 0x4650000 end_va = 0x4664fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2345 start_va = 0x6abd0000 end_va = 0x6ac33fff monitored = 0 entry_point = 0x6ac0e270 region_type = mapped_file name = "werui.dll" filename = "\\Windows\\SysWOW64\\werui.dll" (normalized: "c:\\windows\\syswow64\\werui.dll") Region: id = 2346 start_va = 0x150000 end_va = 0x151fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 2347 start_va = 0x75ca0000 end_va = 0x7709efff monitored = 0 entry_point = 0x75e5b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2348 start_va = 0x74f10000 end_va = 0x75408fff monitored = 0 entry_point = 0x75117610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 2349 start_va = 0x74d60000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d67410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 2350 start_va = 0x74f00000 end_va = 0x74f0efff monitored = 0 entry_point = 0x74f02e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2351 start_va = 0x74820000 end_va = 0x748b1fff monitored = 0 entry_point = 0x74858cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2352 start_va = 0x72d80000 end_va = 0x72f8efff monitored = 0 entry_point = 0x72e2b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 2353 start_va = 0x6aa60000 end_va = 0x6abc6fff monitored = 0 entry_point = 0x6aadb9d0 region_type = mapped_file name = "dui70.dll" filename = "\\Windows\\SysWOW64\\dui70.dll" (normalized: "c:\\windows\\syswow64\\dui70.dll") Region: id = 2354 start_va = 0x6aa30000 end_va = 0x6aa57fff monitored = 0 entry_point = 0x6aa37820 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 2355 start_va = 0x4650000 end_va = 0x4651fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 2356 start_va = 0x4660000 end_va = 0x4660fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 2357 start_va = 0x4670000 end_va = 0x4671fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004670000" filename = "" Region: id = 2358 start_va = 0x4660000 end_va = 0x4660fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004660000" filename = "" Region: id = 2359 start_va = 0x75700000 end_va = 0x75783fff monitored = 0 entry_point = 0x75726220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2360 start_va = 0x4680000 end_va = 0x4680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004680000" filename = "" Region: id = 2361 start_va = 0x6a9f0000 end_va = 0x6aa23fff monitored = 0 entry_point = 0x6aa08280 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll") Region: id = 2362 start_va = 0x4890000 end_va = 0x48cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 2363 start_va = 0x48d0000 end_va = 0x490ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 2364 start_va = 0x6980000 end_va = 0x69bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006980000" filename = "" Region: id = 2365 start_va = 0x69c0000 end_va = 0x69fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000069c0000" filename = "" Region: id = 2366 start_va = 0x6a00000 end_va = 0x6a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 2367 start_va = 0x6a40000 end_va = 0x6a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a40000" filename = "" Region: id = 2368 start_va = 0x6a9e0000 end_va = 0x6a9e8fff monitored = 0 entry_point = 0x6a9e3830 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll") Region: id = 2492 start_va = 0x4660000 end_va = 0x4660fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004660000" filename = "" Region: id = 2493 start_va = 0x6a9f0000 end_va = 0x6aa23fff monitored = 0 entry_point = 0x6aa08280 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll") Region: id = 2494 start_va = 0x6a9e0000 end_va = 0x6a9e8fff monitored = 0 entry_point = 0x6a9e3830 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll") Region: id = 2495 start_va = 0x4660000 end_va = 0x4664fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "werui.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\werui.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\werui.dll.mui") Region: id = 2496 start_va = 0x6a80000 end_va = 0x6a80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006a80000" filename = "" Region: id = 2497 start_va = 0x6a9f0000 end_va = 0x6aa23fff monitored = 0 entry_point = 0x6aa08280 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll") Region: id = 2498 start_va = 0x6a9e0000 end_va = 0x6a9e8fff monitored = 0 entry_point = 0x6a9e3830 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll") Region: id = 2499 start_va = 0x6a80000 end_va = 0x6abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a80000" filename = "" Region: id = 2500 start_va = 0x6ac0000 end_va = 0x6afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ac0000" filename = "" Region: id = 2501 start_va = 0x6b00000 end_va = 0x6b00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006b00000" filename = "" Region: id = 2502 start_va = 0x6a9f0000 end_va = 0x6aa23fff monitored = 0 entry_point = 0x6aa08280 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll") Region: id = 2503 start_va = 0x6a9e0000 end_va = 0x6a9e8fff monitored = 0 entry_point = 0x6a9e3830 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll") Region: id = 2504 start_va = 0x6b00000 end_va = 0x6b01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006b00000" filename = "" Region: id = 2505 start_va = 0x6a9b0000 end_va = 0x6aa2afff monitored = 0 entry_point = 0x6a9d4d80 region_type = mapped_file name = "duser.dll" filename = "\\Windows\\SysWOW64\\duser.dll" (normalized: "c:\\windows\\syswow64\\duser.dll") Region: id = 2506 start_va = 0x6b10000 end_va = 0x6b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b10000" filename = "" Region: id = 2507 start_va = 0x6b50000 end_va = 0x6b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b50000" filename = "" Region: id = 2508 start_va = 0x6a920000 end_va = 0x6a9a0fff monitored = 0 entry_point = 0x6a926310 region_type = mapped_file name = "riched20.dll" filename = "\\Windows\\SysWOW64\\riched20.dll" (normalized: "c:\\windows\\syswow64\\riched20.dll") Region: id = 2509 start_va = 0x6a900000 end_va = 0x6a915fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2510 start_va = 0x6a8c0000 end_va = 0x6a8f0fff monitored = 0 entry_point = 0x6a8d22d0 region_type = mapped_file name = "msls31.dll" filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll") Region: id = 2511 start_va = 0x6b90000 end_va = 0x6b90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006b90000" filename = "" Region: id = 2512 start_va = 0x6b90000 end_va = 0x6c4bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006b90000" filename = "" Region: id = 2513 start_va = 0x6c50000 end_va = 0x6c53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006c50000" filename = "" Region: id = 2514 start_va = 0x73e00000 end_va = 0x73e1cfff monitored = 0 entry_point = 0x73e03b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 2515 start_va = 0x6c60000 end_va = 0x6c63fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 2516 start_va = 0x6c70000 end_va = 0x6c70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006c70000" filename = "" Region: id = 2517 start_va = 0x6c80000 end_va = 0x6c80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006c80000" filename = "" Region: id = 2518 start_va = 0x6fb20000 end_va = 0x6fb4cfff monitored = 0 entry_point = 0x6fb32b00 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\SysWOW64\\xmllite.dll" (normalized: "c:\\windows\\syswow64\\xmllite.dll") Region: id = 2519 start_va = 0x6c90000 end_va = 0x6c90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "duser.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\duser.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\duser.dll.mui") Region: id = 2520 start_va = 0x6a8b0000 end_va = 0x6a8bcfff monitored = 0 entry_point = 0x6a8b7d80 region_type = mapped_file name = "atlthunk.dll" filename = "\\Windows\\SysWOW64\\atlthunk.dll" (normalized: "c:\\windows\\syswow64\\atlthunk.dll") Region: id = 2521 start_va = 0x6ca0000 end_va = 0x6ca2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "comctl32.dll.mui" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.10586.0_en-us_e9ce2dce92807715\\comctl32.dll.mui" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.10586.0_en-us_e9ce2dce92807715\\comctl32.dll.mui") Region: id = 2522 start_va = 0x6cc0000 end_va = 0x6cc2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006cc0000" filename = "" Region: id = 2523 start_va = 0x6cd0000 end_va = 0x71c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006cd0000" filename = "" Region: id = 2524 start_va = 0x71d0000 end_va = 0x820ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 2525 start_va = 0x8210000 end_va = 0x8258fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008210000" filename = "" Region: id = 2526 start_va = 0x6cb0000 end_va = 0x6cb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006cb0000" filename = "" Region: id = 2527 start_va = 0x75b80000 end_va = 0x75c9efff monitored = 0 entry_point = 0x75bc5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Thread: id = 167 os_tid = 0x1220 [0166.855] GetProcessHeap () returned 0x4690000 [0166.860] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0166.860] GetProcAddress (hModule=0x770a0000, lpProcName="FlsAlloc") returned 0x770ba980 [0166.860] GetProcAddress (hModule=0x770a0000, lpProcName="FlsFree") returned 0x770c4ff0 [0166.861] GetProcAddress (hModule=0x770a0000, lpProcName="FlsGetValue") returned 0x770b7570 [0166.861] GetProcAddress (hModule=0x770a0000, lpProcName="FlsSetValue") returned 0x770b9e30 [0166.861] GetProcAddress (hModule=0x770a0000, lpProcName="InitializeCriticalSectionEx") returned 0x770c6740 [0166.861] GetProcAddress (hModule=0x770a0000, lpProcName="CreateEventExW") returned 0x770c66a0 [0166.861] GetProcAddress (hModule=0x770a0000, lpProcName="CreateSemaphoreExW") returned 0x770c6700 [0166.861] GetProcAddress (hModule=0x770a0000, lpProcName="SetThreadStackGuarantee") returned 0x770bb040 [0166.861] GetProcAddress (hModule=0x770a0000, lpProcName="CreateThreadpoolTimer") returned 0x770bace0 [0166.862] GetProcAddress (hModule=0x770a0000, lpProcName="SetThreadpoolTimer") returned 0x77267dc0 [0166.862] GetProcAddress (hModule=0x770a0000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x77274010 [0166.862] GetProcAddress (hModule=0x770a0000, lpProcName="CloseThreadpoolTimer") returned 0x77272a50 [0166.862] GetProcAddress (hModule=0x770a0000, lpProcName="CreateThreadpoolWait") returned 0x770ba7b0 [0166.862] GetProcAddress (hModule=0x770a0000, lpProcName="SetThreadpoolWait") returned 0x77272290 [0166.862] GetProcAddress (hModule=0x770a0000, lpProcName="CloseThreadpoolWait") returned 0x77272910 [0166.862] GetProcAddress (hModule=0x770a0000, lpProcName="FlushProcessWriteBuffers") returned 0x77297a60 [0166.863] GetProcAddress (hModule=0x770a0000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7728ac00 [0166.863] GetProcAddress (hModule=0x770a0000, lpProcName="GetCurrentProcessorNumber") returned 0x7727a890 [0166.863] GetProcAddress (hModule=0x770a0000, lpProcName="GetLogicalProcessorInformation") returned 0x770bac80 [0166.863] GetProcAddress (hModule=0x770a0000, lpProcName="CreateSymbolicLinkW") returned 0x770e0830 [0166.863] GetProcAddress (hModule=0x770a0000, lpProcName="SetDefaultDllDirectories") returned 0x74a56270 [0166.863] GetProcAddress (hModule=0x770a0000, lpProcName="EnumSystemLocalesEx") returned 0x770bfe80 [0166.863] GetProcAddress (hModule=0x770a0000, lpProcName="CompareStringEx") returned 0x770bff80 [0166.864] GetProcAddress (hModule=0x770a0000, lpProcName="GetDateFormatEx") returned 0x770e0e00 [0166.864] GetProcAddress (hModule=0x770a0000, lpProcName="GetLocaleInfoEx") returned 0x770ba750 [0166.864] GetProcAddress (hModule=0x770a0000, lpProcName="GetTimeFormatEx") returned 0x770e1240 [0166.864] GetProcAddress (hModule=0x770a0000, lpProcName="GetUserDefaultLocaleName") returned 0x770bad60 [0166.864] GetProcAddress (hModule=0x770a0000, lpProcName="IsValidLocaleName") returned 0x770e1460 [0166.864] GetProcAddress (hModule=0x770a0000, lpProcName="LCMapStringEx") returned 0x770b9a10 [0166.864] GetProcAddress (hModule=0x770a0000, lpProcName="GetCurrentPackageId") returned 0x749dded0 [0166.865] GetProcAddress (hModule=0x770a0000, lpProcName="GetTickCount64") returned 0x770b3630 [0166.865] GetProcAddress (hModule=0x770a0000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0166.865] GetProcAddress (hModule=0x770a0000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0166.866] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x3bc) returned 0x469f9d8 [0166.866] GetCurrentThreadId () returned 0x1220 [0166.866] GetCommandLineA () returned="C:\\Windows\\SysWOW64\\WerFault.exe -u -p 4844 -s 1816" [0166.867] GetEnvironmentStringsW () returned 0x46a2fb8* [0166.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1428, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1428 [0166.867] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x594) returned 0x46a3ae8 [0166.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1428, lpMultiByteStr=0x46a3ae8, cbMultiByte=1428, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1428 [0166.867] FreeEnvironmentStringsW (penv=0x46a2fb8) returned 1 [0166.867] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x18) returned 0x4692c08 [0166.868] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x800) returned 0x46a2fb8 [0166.868] GetStartupInfoW (in: lpStartupInfo=0xcbfe8 | out: lpStartupInfo=0xcbfe8*(cb=0x44, lpReserved="", lpDesktop="", lpTitle="C:\\Windows\\SysWOW64\\WerFault.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x5127aa02, hStdOutput=0xcc05c, hStdError=0x6ad3193a)) [0166.868] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0166.868] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.868] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0166.868] GetLastError () returned 0x7f [0166.868] SetLastError (dwErrCode=0x7f) [0166.868] GetLastError () returned 0x7f [0166.868] SetLastError (dwErrCode=0x7f) [0166.868] GetLastError () returned 0x7f [0166.868] SetLastError (dwErrCode=0x7f) [0166.868] GetACP () returned 0x4e4 [0166.868] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x220) returned 0x469fda0 [0166.868] GetLastError () returned 0x7f [0166.869] SetLastError (dwErrCode=0x7f) [0166.869] IsValidCodePage (CodePage=0x4e4) returned 1 [0166.869] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xcbfe8 | out: lpCPInfo=0xcbfe8) returned 1 [0166.869] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xcbab0 | out: lpCPInfo=0xcbab0) returned 1 [0166.869] GetLastError () returned 0x7f [0166.869] SetLastError (dwErrCode=0x7f) [0166.869] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ<Àýº", cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0166.875] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ<Àýº", cbMultiByte=256, lpWideCharStr=0xcb828, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0166.875] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0xcbac4 | out: lpCharType=0xcbac4) returned 1 [0166.875] GetLastError () returned 0x7f [0166.876] SetLastError (dwErrCode=0x7f) [0166.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ<Àýº", cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0166.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ<Àýº", cbMultiByte=256, lpWideCharStr=0xcb7f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0166.876] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0166.876] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xcb5e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0166.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0xcbdc4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ<Àýº", lpUsedDefaultChar=0x0) returned 256 [0166.876] GetLastError () returned 0x7f [0166.876] SetLastError (dwErrCode=0x7f) [0166.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ<Àýº", cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0166.876] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ<Àýº", cbMultiByte=256, lpWideCharStr=0xcb818, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0166.876] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0166.876] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpDestStr=0xcb608, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0166.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0xcbcc4, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ<Àýº", lpUsedDefaultChar=0x0) returned 256 [0166.877] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6ad72590, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WerFault.exe" (normalized: "c:\\windows\\syswow64\\werfault.exe")) returned 0x20 [0166.877] GetLastError () returned 0x0 [0166.877] SetLastError (dwErrCode=0x0) [0166.877] GetLastError () returned 0x0 [0166.877] SetLastError (dwErrCode=0x0) [0166.877] GetLastError () returned 0x0 [0166.877] SetLastError (dwErrCode=0x0) [0166.877] GetLastError () returned 0x0 [0166.877] SetLastError (dwErrCode=0x0) [0166.877] GetLastError () returned 0x0 [0166.877] SetLastError (dwErrCode=0x0) [0166.877] GetLastError () returned 0x0 [0166.877] SetLastError (dwErrCode=0x0) [0166.877] GetLastError () returned 0x0 [0166.877] SetLastError (dwErrCode=0x0) [0166.878] GetLastError () returned 0x0 [0166.878] SetLastError (dwErrCode=0x0) [0166.878] GetLastError () returned 0x0 [0166.878] SetLastError (dwErrCode=0x0) [0166.878] GetLastError () returned 0x0 [0166.878] SetLastError (dwErrCode=0x0) [0166.878] GetLastError () returned 0x0 [0166.878] SetLastError (dwErrCode=0x0) [0166.878] GetLastError () returned 0x0 [0166.878] SetLastError (dwErrCode=0x0) [0166.878] GetLastError () returned 0x0 [0166.878] SetLastError (dwErrCode=0x0) [0166.878] GetLastError () returned 0x0 [0166.878] SetLastError (dwErrCode=0x0) [0166.878] GetLastError () returned 0x0 [0166.879] SetLastError (dwErrCode=0x0) [0166.879] GetLastError () returned 0x0 [0166.879] SetLastError (dwErrCode=0x0) [0166.879] GetLastError () returned 0x0 [0166.879] SetLastError (dwErrCode=0x0) [0166.879] GetLastError () returned 0x0 [0166.879] SetLastError (dwErrCode=0x0) [0166.879] GetLastError () returned 0x0 [0166.879] SetLastError (dwErrCode=0x0) [0166.879] GetLastError () returned 0x0 [0166.879] SetLastError (dwErrCode=0x0) [0166.879] GetLastError () returned 0x0 [0166.879] SetLastError (dwErrCode=0x0) [0166.879] GetLastError () returned 0x0 [0166.879] SetLastError (dwErrCode=0x0) [0166.880] GetLastError () returned 0x0 [0166.880] SetLastError (dwErrCode=0x0) [0166.880] GetLastError () returned 0x0 [0166.880] SetLastError (dwErrCode=0x0) [0166.880] GetLastError () returned 0x0 [0166.880] SetLastError (dwErrCode=0x0) [0166.880] GetLastError () returned 0x0 [0166.880] SetLastError (dwErrCode=0x0) [0166.880] GetLastError () returned 0x0 [0166.880] SetLastError (dwErrCode=0x0) [0166.880] GetLastError () returned 0x0 [0166.880] SetLastError (dwErrCode=0x0) [0166.880] GetLastError () returned 0x0 [0166.880] SetLastError (dwErrCode=0x0) [0166.880] GetLastError () returned 0x0 [0166.881] SetLastError (dwErrCode=0x0) [0166.881] GetLastError () returned 0x0 [0166.881] SetLastError (dwErrCode=0x0) [0166.881] GetLastError () returned 0x0 [0166.881] SetLastError (dwErrCode=0x0) [0166.881] GetLastError () returned 0x0 [0166.881] SetLastError (dwErrCode=0x0) [0166.881] GetLastError () returned 0x0 [0166.881] SetLastError (dwErrCode=0x0) [0166.881] GetLastError () returned 0x0 [0166.881] SetLastError (dwErrCode=0x0) [0166.881] GetLastError () returned 0x0 [0166.881] SetLastError (dwErrCode=0x0) [0166.881] GetLastError () returned 0x0 [0166.881] SetLastError (dwErrCode=0x0) [0166.882] GetLastError () returned 0x0 [0166.882] SetLastError (dwErrCode=0x0) [0166.882] GetLastError () returned 0x0 [0166.882] SetLastError (dwErrCode=0x0) [0166.882] GetLastError () returned 0x0 [0166.882] SetLastError (dwErrCode=0x0) [0166.882] GetLastError () returned 0x0 [0166.882] SetLastError (dwErrCode=0x0) [0166.882] GetLastError () returned 0x0 [0166.882] SetLastError (dwErrCode=0x0) [0166.882] GetLastError () returned 0x0 [0166.882] SetLastError (dwErrCode=0x0) [0166.882] GetLastError () returned 0x0 [0166.882] SetLastError (dwErrCode=0x0) [0166.882] GetLastError () returned 0x0 [0166.883] SetLastError (dwErrCode=0x0) [0166.883] GetLastError () returned 0x0 [0166.883] SetLastError (dwErrCode=0x0) [0166.883] GetLastError () returned 0x0 [0166.883] SetLastError (dwErrCode=0x0) [0166.883] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x50) returned 0x4693850 [0166.883] GetLastError () returned 0x0 [0166.883] SetLastError (dwErrCode=0x0) [0166.883] GetLastError () returned 0x0 [0166.883] SetLastError (dwErrCode=0x0) [0166.883] GetLastError () returned 0x0 [0166.883] SetLastError (dwErrCode=0x0) [0166.883] GetLastError () returned 0x0 [0166.883] SetLastError (dwErrCode=0x0) [0166.883] GetLastError () returned 0x0 [0166.883] SetLastError (dwErrCode=0x0) [0166.883] GetLastError () returned 0x0 [0166.884] SetLastError (dwErrCode=0x0) [0166.884] GetLastError () returned 0x0 [0166.884] SetLastError (dwErrCode=0x0) [0166.884] GetLastError () returned 0x0 [0166.884] SetLastError (dwErrCode=0x0) [0166.884] GetLastError () returned 0x0 [0166.884] SetLastError (dwErrCode=0x0) [0166.884] GetLastError () returned 0x0 [0166.884] SetLastError (dwErrCode=0x0) [0166.884] GetLastError () returned 0x0 [0166.884] SetLastError (dwErrCode=0x0) [0166.884] GetLastError () returned 0x0 [0166.884] SetLastError (dwErrCode=0x0) [0166.884] GetLastError () returned 0x0 [0166.884] SetLastError (dwErrCode=0x0) [0166.884] GetLastError () returned 0x0 [0166.885] SetLastError (dwErrCode=0x0) [0166.885] GetLastError () returned 0x0 [0166.885] SetLastError (dwErrCode=0x0) [0166.885] GetLastError () returned 0x0 [0166.885] SetLastError (dwErrCode=0x0) [0166.885] GetLastError () returned 0x0 [0166.885] SetLastError (dwErrCode=0x0) [0166.885] GetLastError () returned 0x0 [0166.885] SetLastError (dwErrCode=0x0) [0166.885] GetLastError () returned 0x0 [0166.885] SetLastError (dwErrCode=0x0) [0166.885] GetLastError () returned 0x0 [0166.885] SetLastError (dwErrCode=0x0) [0166.885] GetLastError () returned 0x0 [0166.885] SetLastError (dwErrCode=0x0) [0166.885] GetLastError () returned 0x0 [0166.886] SetLastError (dwErrCode=0x0) [0166.886] GetLastError () returned 0x0 [0166.886] SetLastError (dwErrCode=0x0) [0166.886] GetLastError () returned 0x0 [0166.886] SetLastError (dwErrCode=0x0) [0166.886] GetLastError () returned 0x0 [0166.886] SetLastError (dwErrCode=0x0) [0166.886] GetLastError () returned 0x0 [0166.886] SetLastError (dwErrCode=0x0) [0166.886] GetLastError () returned 0x0 [0166.886] SetLastError (dwErrCode=0x0) [0166.886] GetLastError () returned 0x0 [0166.886] SetLastError (dwErrCode=0x0) [0166.886] GetLastError () returned 0x0 [0166.886] SetLastError (dwErrCode=0x0) [0166.887] GetLastError () returned 0x0 [0166.887] SetLastError (dwErrCode=0x0) [0166.887] GetLastError () returned 0x0 [0166.887] SetLastError (dwErrCode=0x0) [0166.887] GetLastError () returned 0x0 [0166.887] SetLastError (dwErrCode=0x0) [0166.887] GetLastError () returned 0x0 [0166.887] SetLastError (dwErrCode=0x0) [0166.887] GetLastError () returned 0x0 [0166.887] SetLastError (dwErrCode=0x0) [0166.887] GetLastError () returned 0x0 [0166.887] SetLastError (dwErrCode=0x0) [0166.887] GetLastError () returned 0x0 [0166.887] SetLastError (dwErrCode=0x0) [0166.887] GetLastError () returned 0x0 [0166.888] SetLastError (dwErrCode=0x0) [0166.888] GetLastError () returned 0x0 [0166.888] SetLastError (dwErrCode=0x0) [0166.888] GetLastError () returned 0x0 [0166.888] SetLastError (dwErrCode=0x0) [0166.888] GetLastError () returned 0x0 [0166.888] SetLastError (dwErrCode=0x0) [0166.888] GetLastError () returned 0x0 [0166.888] SetLastError (dwErrCode=0x0) [0166.888] GetLastError () returned 0x0 [0166.888] SetLastError (dwErrCode=0x0) [0166.888] GetLastError () returned 0x0 [0166.888] SetLastError (dwErrCode=0x0) [0166.888] GetLastError () returned 0x0 [0166.888] SetLastError (dwErrCode=0x0) [0166.888] GetLastError () returned 0x0 [0166.889] SetLastError (dwErrCode=0x0) [0166.889] GetLastError () returned 0x0 [0166.889] SetLastError (dwErrCode=0x0) [0166.889] GetLastError () returned 0x0 [0166.889] SetLastError (dwErrCode=0x0) [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x98) returned 0x46932c8 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x1f) returned 0x469dc38 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x2e) returned 0x4698140 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x35) returned 0x469ffc8 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x37) returned 0x4699900 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x3c) returned 0x469df60 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x31) returned 0x46938a8 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x14) returned 0x4692b28 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x24) returned 0x4693368 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0xd) returned 0x4699ea8 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x1d) returned 0x469da80 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x31) returned 0x46934c0 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x15) returned 0x4692be8 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x1b) returned 0x469da30 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x17) returned 0x46928e8 [0166.889] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0xe) returned 0x4699f50 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0xa2) returned 0x469a160 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x3e) returned 0x469df18 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x1b) returned 0x469db48 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x1d) returned 0x469dc10 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x48) returned 0x469a210 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x12) returned 0x4692948 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x18) returned 0x4692a28 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x1b) returned 0x469db70 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x24) returned 0x4699b40 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x29) returned 0x4698178 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x1e) returned 0x469dbe8 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x69) returned 0x4693500 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x17) returned 0x4692848 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0xf) returned 0x4699f68 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x16) returned 0x4692a68 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x2a) returned 0x46981b0 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x29) returned 0x46981e8 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x12) returned 0x4692b08 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x21) returned 0x46a2b80 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x16) returned 0x4692b48 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x22) returned 0x46a2bb0 [0166.890] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x12) returned 0x46929c8 [0166.891] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46a3ae8 | out: hHeap=0x4690000) returned 1 [0166.892] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x80) returned 0x46a2be0 [0166.892] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x800) returned 0x46a37c0 [0166.892] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0166.892] RtlSizeHeap (HeapHandle=0x4690000, Flags=0x0, MemoryPointer=0x46a2be0) returned 0x80 [0166.895] RtlSizeHeap (HeapHandle=0x4690000, Flags=0x0, MemoryPointer=0x46a2be0) returned 0x80 [0166.895] RtlSizeHeap (HeapHandle=0x4690000, Flags=0x0, MemoryPointer=0x46a2be0) returned 0x80 [0166.895] RtlSizeHeap (HeapHandle=0x4690000, Flags=0x0, MemoryPointer=0x46a2be0) returned 0x80 [0166.896] RtlSizeHeap (HeapHandle=0x4690000, Flags=0x0, MemoryPointer=0x46a2be0) returned 0x80 [0166.897] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0166.897] GetProcAddress (hModule=0x770a0000, lpProcName="GetProcessIdOfThread") returned 0x770bfbd0 [0166.897] GetProcAddress (hModule=0x770a0000, lpProcName="GetThreadId") returned 0x770e11c0 [0166.897] GetProcessIdOfThread (Thread=0x710) returned 0x12ec [0166.898] GetThreadId (Thread=0x710) returned 0x12e4 [0166.899] GetProcessHeap () returned 0x4690000 [0166.899] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x18) returned 0x4692ae8 [0166.900] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc) returned 0x4699f98 [0166.900] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc8) returned 0x469c6d8 [0166.901] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cc8 [0166.901] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x40) returned 0x469e470 [0166.901] GetEnvironmentVariableA (in: lpName="MSCORDACWKS_DEBUG", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0166.904] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120000, lpBuffer=0xcacc8, nSize=0x40, lpNumberOfBytesRead=0xcab3c | out: lpBuffer=0xcacc8*, lpNumberOfBytesRead=0xcab3c*=0x40) returned 1 [0166.904] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120130, lpBuffer=0xcabcc, nSize=0x4, lpNumberOfBytesRead=0xcab3c | out: lpBuffer=0xcabcc*, lpNumberOfBytesRead=0xcab3c*=0x4) returned 1 [0166.905] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120134, lpBuffer=0xcad08, nSize=0x14, lpNumberOfBytesRead=0xcab3c | out: lpBuffer=0xcad08*, lpNumberOfBytesRead=0xcab3c*=0x14) returned 1 [0166.905] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120148, lpBuffer=0xcabd4, nSize=0x2, lpNumberOfBytesRead=0xcab3c | out: lpBuffer=0xcabd4*, lpNumberOfBytesRead=0xcab3c*=0x2) returned 1 [0166.905] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120148, lpBuffer=0xcabe8, nSize=0xe0, lpNumberOfBytesRead=0xcab3c | out: lpBuffer=0xcabe8*, lpNumberOfBytesRead=0xcab3c*=0xe0) returned 1 [0166.905] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f7af000, lpBuffer=0xcacb4, nSize=0x10, lpNumberOfBytesRead=0xcac1c | out: lpBuffer=0xcacb4*, lpNumberOfBytesRead=0xcac1c*=0x10) returned 1 [0166.905] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f7af010, lpBuffer=0xcaca4, nSize=0x8, lpNumberOfBytesRead=0xcac1c | out: lpBuffer=0xcaca4*, lpNumberOfBytesRead=0xcac1c*=0x8) returned 1 [0166.906] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f7af020, lpBuffer=0xcac40, nSize=0x10, lpNumberOfBytesRead=0xcaba4 | out: lpBuffer=0xcac40*, lpNumberOfBytesRead=0xcaba4*=0x10) returned 1 [0166.906] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f7af030, lpBuffer=0xcac2c, nSize=0x8, lpNumberOfBytesRead=0xcaba4 | out: lpBuffer=0xcac2c*, lpNumberOfBytesRead=0xcaba4*=0x8) returned 1 [0166.906] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f7af0d0, lpBuffer=0xcac3c, nSize=0x2, lpNumberOfBytesRead=0xcaba4 | out: lpBuffer=0xcac3c*, lpNumberOfBytesRead=0xcaba4*=0x2) returned 1 [0166.906] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f7af038, lpBuffer=0xcac2c, nSize=0x8, lpNumberOfBytesRead=0xcaba4 | out: lpBuffer=0xcac2c*, lpNumberOfBytesRead=0xcaba4*=0x8) returned 1 [0166.907] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f7af0ea, lpBuffer=0xcac3c, nSize=0x2, lpNumberOfBytesRead=0xcaba4 | out: lpBuffer=0xcac3c*, lpNumberOfBytesRead=0xcaba4*=0x2) returned 1 [0166.907] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f7af0ec, lpBuffer=0xcac50, nSize=0x3a, lpNumberOfBytesRead=0xcaba4 | out: lpBuffer=0xcac50*, lpNumberOfBytesRead=0xcaba4*=0x3a) returned 1 [0166.907] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f7af070, lpBuffer=0xcacb4, nSize=0x10, lpNumberOfBytesRead=0xcac1c | out: lpBuffer=0xcacb4*, lpNumberOfBytesRead=0xcac1c*=0x10) returned 1 [0166.907] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f7af080, lpBuffer=0xcaca4, nSize=0x8, lpNumberOfBytesRead=0xcac1c | out: lpBuffer=0xcaca4*, lpNumberOfBytesRead=0xcac1c*=0x8) returned 1 [0166.907] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f7af0b0, lpBuffer=0xcacfc, nSize=0x10, lpNumberOfBytesRead=0xcac64 | out: lpBuffer=0xcacfc*, lpNumberOfBytesRead=0xcac64*=0x10) returned 1 [0166.908] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x3f0) returned 0x46a3fc8 [0166.908] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f7af14c, lpBuffer=0x46a3fc8, nSize=0x3f0, lpNumberOfBytesRead=0xcacbc | out: lpBuffer=0x46a3fc8*, lpNumberOfBytesRead=0xcacbc*=0x3f0) returned 1 [0166.910] GetCurrentProcess () returned 0xffffffff [0166.910] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0xca248, lpSystemAffinityMask=0xca244 | out: lpProcessAffinityMask=0xca248, lpSystemAffinityMask=0xca244) returned 1 [0166.915] GetEnvironmentVariableW (in: lpName="COMPlus_DbgDACSkipVerifyDlls", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0166.916] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x770a0000 [0166.916] GetProcAddress (hModule=0x770a0000, lpProcName="AcquireSRWLockExclusive") returned 0x7726d210 [0166.916] GetProcAddress (hModule=0x770a0000, lpProcName="ReleaseSRWLockExclusive") returned 0x7726d080 [0166.916] VirtualQuery (in: lpAddress=0x6ad7b000, lpBuffer=0xca588, dwLength=0x1c | out: lpBuffer=0xca588*(BaseAddress=0x6ad7b000, AllocationBase=0x6ac40000, AllocationProtect=0x80, RegionSize=0x12000, State=0x1000, Protect=0x2, Type=0x1000000)) returned 0x1c [0166.916] VirtualProtect (in: lpAddress=0x6ad7b000, dwSize=0x38, flNewProtect=0x4, lpflOldProtect=0x6ad72f14 | out: lpflOldProtect=0x6ad72f14*=0x2) returned 1 [0166.916] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x75a50000 [0166.917] GetProcAddress (hModule=0x75a50000, lpProcName="RegOpenKeyExW") returned 0x75a6f350 [0166.917] VirtualProtect (in: lpAddress=0x6ad7b000, dwSize=0x38, flNewProtect=0x2, lpflOldProtect=0xca5c8 | out: lpflOldProtect=0xca5c8*=0x4) returned 1 [0166.917] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca670 | out: phkResult=0xca670*=0x0) returned 0x2 [0166.917] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca66c | out: phkResult=0xca66c*=0x160) returned 0x0 [0166.918] VirtualProtect (in: lpAddress=0x6ad7b000, dwSize=0x38, flNewProtect=0x4, lpflOldProtect=0x6ad72f14 | out: lpflOldProtect=0x6ad72f14*=0x2) returned 1 [0166.918] GetProcAddress (hModule=0x75a50000, lpProcName="RegQueryValueExW") returned 0x75a6f330 [0166.918] VirtualProtect (in: lpAddress=0x6ad7b000, dwSize=0x38, flNewProtect=0x2, lpflOldProtect=0xca5c4 | out: lpflOldProtect=0xca5c4*=0x4) returned 1 [0166.918] RegQueryValueExW (in: hKey=0x160, lpValueName="DbgDACSkipVerifyDlls", lpReserved=0x0, lpType=0xca674, lpData=0xca654, lpcbData=0xca664*=0x4 | out: lpType=0xca674*=0x0, lpData=0xca654*=0x0, lpcbData=0xca664*=0x4) returned 0x2 [0166.919] VirtualProtect (in: lpAddress=0x6ad7b000, dwSize=0x38, flNewProtect=0x4, lpflOldProtect=0x6ad72f14 | out: lpflOldProtect=0x6ad72f14*=0x2) returned 1 [0166.919] GetProcAddress (hModule=0x75a50000, lpProcName="RegCloseKey") returned 0x75a6f620 [0166.919] VirtualProtect (in: lpAddress=0x6ad7b000, dwSize=0x38, flNewProtect=0x2, lpflOldProtect=0xca5d8 | out: lpflOldProtect=0xca5d8*=0x4) returned 1 [0166.919] RegCloseKey (hKey=0x160) returned 0x0 [0166.921] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x4650000 [0166.921] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120000, lpBuffer=0x4650020, nSize=0x40, lpNumberOfBytesRead=0xca830 | out: lpBuffer=0x4650020*, lpNumberOfBytesRead=0xca830*=0x40) returned 1 [0166.921] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ce0 [0166.922] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120130, lpBuffer=0x4650070, nSize=0xf8, lpNumberOfBytesRead=0xca830 | out: lpBuffer=0x4650070*, lpNumberOfBytesRead=0xca830*=0xf8) returned 1 [0166.922] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cf8 [0166.922] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f1201d8, lpBuffer=0x4650180, nSize=0x8, lpNumberOfBytesRead=0xca814 | out: lpBuffer=0x4650180*, lpNumberOfBytesRead=0xca814*=0x8) returned 1 [0166.922] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d28 [0166.922] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f797894, lpBuffer=0x46501a0, nSize=0x1c, lpNumberOfBytesRead=0xca850 | out: lpBuffer=0x46501a0*, lpNumberOfBytesRead=0xca850*=0x1c) returned 1 [0166.922] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d70 [0166.922] GetLastError () returned 0xcb [0166.922] SetLastError (dwErrCode=0xcb) [0166.923] GetLastError () returned 0xcb [0166.923] SetLastError (dwErrCode=0xcb) [0166.923] GetLastError () returned 0xcb [0166.923] SetLastError (dwErrCode=0xcb) [0166.925] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f798138, lpBuffer=0x46501d0, nSize=0x4, lpNumberOfBytesRead=0xcad00 | out: lpBuffer=0x46501d0*, lpNumberOfBytesRead=0xcad00*=0x4) returned 1 [0166.925] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a058 [0166.925] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ab0, lpBuffer=0x46501f0, nSize=0x64, lpNumberOfBytesRead=0xcad00 | out: lpBuffer=0x46501f0*, lpNumberOfBytesRead=0xcad00*=0x64) returned 1 [0166.925] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a070 [0166.925] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ad4, lpBuffer=0x4650270, nSize=0x4, lpNumberOfBytesRead=0xcacfc | out: lpBuffer=0x4650270*, lpNumberOfBytesRead=0xcacfc*=0x4) returned 1 [0166.925] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a028 [0166.925] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf9294c, lpBuffer=0x4650290, nSize=0x4, lpNumberOfBytesRead=0xcacfc | out: lpBuffer=0x4650290*, lpNumberOfBytesRead=0xcacfc*=0x4) returned 1 [0166.926] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a040 [0166.926] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0xcad88, nSize=0x4, lpNumberOfBytesRead=0xcacf4 | out: lpBuffer=0xcad88*, lpNumberOfBytesRead=0xcacf4*=0x4) returned 1 [0166.926] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0x46502b0, nSize=0x540, lpNumberOfBytesRead=0xcacf4 | out: lpBuffer=0x46502b0*, lpNumberOfBytesRead=0xcacf4*=0x540) returned 1 [0166.926] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fb0 [0166.926] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x200) returned 0x4692c28 [0166.926] GetProcessHeap () returned 0x4690000 [0166.927] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469e470 | out: hHeap=0x4690000) returned 1 [0166.937] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xe0146c, lpBuffer=0x4650800, nSize=0x4, lpNumberOfBytesRead=0xcacf0 | out: lpBuffer=0x4650800*, lpNumberOfBytesRead=0xcacf0*=0x4) returned 1 [0166.937] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fc8 [0166.937] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732734, lpBuffer=0x4650820, nSize=0x50, lpNumberOfBytesRead=0xcacf0 | out: lpBuffer=0x4650820*, lpNumberOfBytesRead=0xcacf0*=0x50) returned 1 [0166.938] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fe0 [0166.938] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f40, lpBuffer=0x4650880, nSize=0xc, lpNumberOfBytesRead=0xcacf0 | out: lpBuffer=0x4650880*, lpNumberOfBytesRead=0xcacf0*=0xc) returned 1 [0166.938] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ff8 [0166.938] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6e224448, lpBuffer=0x46508a0, nSize=0x28, lpNumberOfBytesRead=0xcacf0 | out: lpBuffer=0x46508a0*, lpNumberOfBytesRead=0xcacf0*=0x28) returned 1 [0166.938] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a010 [0166.938] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f48, lpBuffer=0xcae6c, nSize=0xb8, lpNumberOfBytesRead=0xcad40 | out: lpBuffer=0xcae6c*, lpNumberOfBytesRead=0xcad40*=0xb8) returned 1 [0166.938] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2733000, lpBuffer=0xcaf24, nSize=0x1000, lpNumberOfBytesRead=0xcad40 | out: lpBuffer=0xcaf24*, lpNumberOfBytesRead=0xcad40*=0x1000) returned 1 [0166.939] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2734000, lpBuffer=0xcbf24, nSize=0x538, lpNumberOfBytesRead=0xcad40 | out: lpBuffer=0xcbf24*, lpNumberOfBytesRead=0xcad40*=0x538) returned 1 [0166.939] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699f98 | out: hHeap=0x4690000) returned 1 [0166.939] VirtualFree (lpAddress=0x4650000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.941] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ce0 | out: hHeap=0x4690000) returned 1 [0166.941] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a070 | out: hHeap=0x4690000) returned 1 [0166.941] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cf8 | out: hHeap=0x4690000) returned 1 [0166.941] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d28 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a058 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a028 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d70 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a040 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fb0 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fc8 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fe0 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ff8 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a010 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692c28 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cc8 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469c6d8 | out: hHeap=0x4690000) returned 1 [0166.942] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692ae8 | out: hHeap=0x4690000) returned 1 [0166.942] OutOfProcessExceptionEventDebuggerLaunchCallback () returned 0x0 [0167.300] OutOfProcessExceptionEventSignatureCallback () returned 0x0 [0167.301] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0167.301] GetProcAddress (hModule=0x770a0000, lpProcName="GetProcessIdOfThread") returned 0x770bfbd0 [0167.301] GetProcAddress (hModule=0x770a0000, lpProcName="GetThreadId") returned 0x770e11c0 [0167.301] GetProcessIdOfThread (Thread=0x710) returned 0x12ec [0167.302] GetThreadId (Thread=0x710) returned 0x12e4 [0167.302] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x18) returned 0x46929a8 [0167.302] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc) returned 0x4699cf8 [0167.302] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc8) returned 0x469c6d8 [0167.302] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699f98 [0167.302] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x40) returned 0x469dfa8 [0167.302] GetEnvironmentVariableA (in: lpName="MSCORDACWKS_DEBUG", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.303] GetEnvironmentVariableW (in: lpName="COMPlus_DbgDACSkipVerifyDlls", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.303] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca938 | out: phkResult=0xca938*=0x0) returned 0x2 [0167.303] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca934 | out: phkResult=0xca934*=0x160) returned 0x0 [0167.303] RegQueryValueExW (in: hKey=0x160, lpValueName="DbgDACSkipVerifyDlls", lpReserved=0x0, lpType=0xca93c, lpData=0xca91c, lpcbData=0xca92c*=0x4 | out: lpType=0xca93c*=0x0, lpData=0xca91c*=0x0, lpcbData=0xca92c*=0x4) returned 0x2 [0167.303] RegCloseKey (hKey=0x160) returned 0x0 [0167.303] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x4650000 [0167.304] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120000, lpBuffer=0x4650020, nSize=0x40, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650020*, lpNumberOfBytesRead=0xcaaf8*=0x40) returned 1 [0167.304] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cc8 [0167.304] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120130, lpBuffer=0x4650070, nSize=0xf8, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650070*, lpNumberOfBytesRead=0xcaaf8*=0xf8) returned 1 [0167.304] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ce0 [0167.305] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f1201d8, lpBuffer=0x4650180, nSize=0x8, lpNumberOfBytesRead=0xcaadc | out: lpBuffer=0x4650180*, lpNumberOfBytesRead=0xcaadc*=0x8) returned 1 [0167.305] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d28 [0167.305] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f797894, lpBuffer=0x46501a0, nSize=0x1c, lpNumberOfBytesRead=0xcab18 | out: lpBuffer=0x46501a0*, lpNumberOfBytesRead=0xcab18*=0x1c) returned 1 [0167.305] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d70 [0167.305] GetLastError () returned 0xcb [0167.305] SetLastError (dwErrCode=0xcb) [0167.305] GetLastError () returned 0xcb [0167.305] SetLastError (dwErrCode=0xcb) [0167.305] GetLastError () returned 0xcb [0167.305] SetLastError (dwErrCode=0xcb) [0167.305] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f798138, lpBuffer=0x46501d0, nSize=0x4, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501d0*, lpNumberOfBytesRead=0xcafc8*=0x4) returned 1 [0167.305] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fc8 [0167.305] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ab0, lpBuffer=0x46501f0, nSize=0x64, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501f0*, lpNumberOfBytesRead=0xcafc8*=0x64) returned 1 [0167.306] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a028 [0167.306] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ad4, lpBuffer=0x4650270, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650270*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.306] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ff8 [0167.306] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf9294c, lpBuffer=0x4650290, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650290*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.306] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a010 [0167.306] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0xcb050, nSize=0x4, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0xcb050*, lpNumberOfBytesRead=0xcafbc*=0x4) returned 1 [0167.306] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0x46502b0, nSize=0x540, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0x46502b0*, lpNumberOfBytesRead=0xcafbc*=0x540) returned 1 [0167.306] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a040 [0167.306] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x200) returned 0x4692c28 [0167.307] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469dfa8 | out: hHeap=0x4690000) returned 1 [0167.307] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xe0146c, lpBuffer=0x4650800, nSize=0x4, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650800*, lpNumberOfBytesRead=0xcafb8*=0x4) returned 1 [0167.307] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fe0 [0167.307] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732734, lpBuffer=0x4650820, nSize=0x50, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650820*, lpNumberOfBytesRead=0xcafb8*=0x50) returned 1 [0167.307] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a058 [0167.307] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f40, lpBuffer=0x4650880, nSize=0xc, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650880*, lpNumberOfBytesRead=0xcafb8*=0xc) returned 1 [0167.307] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fb0 [0167.307] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6e224448, lpBuffer=0x46508a0, nSize=0x28, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x46508a0*, lpNumberOfBytesRead=0xcafb8*=0x28) returned 1 [0167.307] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a070 [0167.307] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f48, lpBuffer=0xcb130, nSize=0xb8, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb130*, lpNumberOfBytesRead=0xcb008*=0xb8) returned 1 [0167.308] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2733000, lpBuffer=0xcb1e8, nSize=0x1000, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb1e8*, lpNumberOfBytesRead=0xcb008*=0x1000) returned 1 [0167.308] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2734000, lpBuffer=0xcc1e8, nSize=0x538, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcc1e8*, lpNumberOfBytesRead=0xcb008*=0x538) returned 1 [0167.308] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cf8 | out: hHeap=0x4690000) returned 1 [0167.308] VirtualFree (lpAddress=0x4650000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cc8 | out: hHeap=0x4690000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a028 | out: hHeap=0x4690000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ce0 | out: hHeap=0x4690000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d28 | out: hHeap=0x4690000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fc8 | out: hHeap=0x4690000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ff8 | out: hHeap=0x4690000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d70 | out: hHeap=0x4690000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a010 | out: hHeap=0x4690000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a040 | out: hHeap=0x4690000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fe0 | out: hHeap=0x4690000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a058 | out: hHeap=0x4690000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fb0 | out: hHeap=0x4690000) returned 1 [0167.311] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a070 | out: hHeap=0x4690000) returned 1 [0167.312] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692c28 | out: hHeap=0x4690000) returned 1 [0167.312] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699f98 | out: hHeap=0x4690000) returned 1 [0167.312] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469c6d8 | out: hHeap=0x4690000) returned 1 [0167.312] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46929a8 | out: hHeap=0x4690000) returned 1 [0167.312] OutOfProcessExceptionEventSignatureCallback () returned 0x0 [0167.312] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0167.312] GetProcAddress (hModule=0x770a0000, lpProcName="GetProcessIdOfThread") returned 0x770bfbd0 [0167.312] GetProcAddress (hModule=0x770a0000, lpProcName="GetThreadId") returned 0x770e11c0 [0167.313] GetProcessIdOfThread (Thread=0x710) returned 0x12ec [0167.313] GetThreadId (Thread=0x710) returned 0x12e4 [0167.313] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x18) returned 0x4692ba8 [0167.313] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc) returned 0x4699d28 [0167.313] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc8) returned 0x469beb8 [0167.313] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699f98 [0167.313] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x40) returned 0x469ddb0 [0167.313] GetEnvironmentVariableA (in: lpName="MSCORDACWKS_DEBUG", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.313] GetEnvironmentVariableW (in: lpName="COMPlus_DbgDACSkipVerifyDlls", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.313] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca938 | out: phkResult=0xca938*=0x0) returned 0x2 [0167.313] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca934 | out: phkResult=0xca934*=0x160) returned 0x0 [0167.314] RegQueryValueExW (in: hKey=0x160, lpValueName="DbgDACSkipVerifyDlls", lpReserved=0x0, lpType=0xca93c, lpData=0xca91c, lpcbData=0xca92c*=0x4 | out: lpType=0xca93c*=0x0, lpData=0xca91c*=0x0, lpcbData=0xca92c*=0x4) returned 0x2 [0167.314] RegCloseKey (hKey=0x160) returned 0x0 [0167.314] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x4650000 [0167.314] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120000, lpBuffer=0x4650020, nSize=0x40, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650020*, lpNumberOfBytesRead=0xcaaf8*=0x40) returned 1 [0167.314] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cf8 [0167.314] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120130, lpBuffer=0x4650070, nSize=0xf8, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650070*, lpNumberOfBytesRead=0xcaaf8*=0xf8) returned 1 [0167.314] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d70 [0167.314] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f1201d8, lpBuffer=0x4650180, nSize=0x8, lpNumberOfBytesRead=0xcaadc | out: lpBuffer=0x4650180*, lpNumberOfBytesRead=0xcaadc*=0x8) returned 1 [0167.315] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cc8 [0167.315] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f797894, lpBuffer=0x46501a0, nSize=0x1c, lpNumberOfBytesRead=0xcab18 | out: lpBuffer=0x46501a0*, lpNumberOfBytesRead=0xcab18*=0x1c) returned 1 [0167.315] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ce0 [0167.315] GetLastError () returned 0xcb [0167.315] SetLastError (dwErrCode=0xcb) [0167.315] GetLastError () returned 0xcb [0167.315] SetLastError (dwErrCode=0xcb) [0167.315] GetLastError () returned 0xcb [0167.315] SetLastError (dwErrCode=0xcb) [0167.315] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f798138, lpBuffer=0x46501d0, nSize=0x4, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501d0*, lpNumberOfBytesRead=0xcafc8*=0x4) returned 1 [0167.315] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fb0 [0167.315] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ab0, lpBuffer=0x46501f0, nSize=0x64, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501f0*, lpNumberOfBytesRead=0xcafc8*=0x64) returned 1 [0167.315] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a040 [0167.315] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ad4, lpBuffer=0x4650270, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650270*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.316] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a070 [0167.316] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf9294c, lpBuffer=0x4650290, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650290*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.316] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a010 [0167.316] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0xcb050, nSize=0x4, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0xcb050*, lpNumberOfBytesRead=0xcafbc*=0x4) returned 1 [0167.316] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0x46502b0, nSize=0x540, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0x46502b0*, lpNumberOfBytesRead=0xcafbc*=0x540) returned 1 [0167.316] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a028 [0167.316] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x200) returned 0x4692c28 [0167.317] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469ddb0 | out: hHeap=0x4690000) returned 1 [0167.317] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xe0146c, lpBuffer=0x4650800, nSize=0x4, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650800*, lpNumberOfBytesRead=0xcafb8*=0x4) returned 1 [0167.317] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fc8 [0167.317] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732734, lpBuffer=0x4650820, nSize=0x50, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650820*, lpNumberOfBytesRead=0xcafb8*=0x50) returned 1 [0167.317] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fe0 [0167.317] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f40, lpBuffer=0x4650880, nSize=0xc, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650880*, lpNumberOfBytesRead=0xcafb8*=0xc) returned 1 [0167.317] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ff8 [0167.317] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6e224448, lpBuffer=0x46508a0, nSize=0x28, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x46508a0*, lpNumberOfBytesRead=0xcafb8*=0x28) returned 1 [0167.317] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a058 [0167.317] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f48, lpBuffer=0xcb130, nSize=0xb8, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb130*, lpNumberOfBytesRead=0xcb008*=0xb8) returned 1 [0167.317] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2733000, lpBuffer=0xcb1e8, nSize=0x1000, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb1e8*, lpNumberOfBytesRead=0xcb008*=0x1000) returned 1 [0167.318] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2734000, lpBuffer=0xcc1e8, nSize=0x538, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcc1e8*, lpNumberOfBytesRead=0xcb008*=0x538) returned 1 [0167.318] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d28 | out: hHeap=0x4690000) returned 1 [0167.318] VirtualFree (lpAddress=0x4650000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cf8 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a040 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d70 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cc8 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fb0 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a070 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ce0 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a010 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a028 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fc8 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fe0 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ff8 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a058 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692c28 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699f98 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469beb8 | out: hHeap=0x4690000) returned 1 [0167.321] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692ba8 | out: hHeap=0x4690000) returned 1 [0167.321] OutOfProcessExceptionEventSignatureCallback () returned 0x0 [0167.322] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0167.322] GetProcAddress (hModule=0x770a0000, lpProcName="GetProcessIdOfThread") returned 0x770bfbd0 [0167.322] GetProcAddress (hModule=0x770a0000, lpProcName="GetThreadId") returned 0x770e11c0 [0167.322] GetProcessIdOfThread (Thread=0x710) returned 0x12ec [0167.322] GetThreadId (Thread=0x710) returned 0x12e4 [0167.322] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x18) returned 0x46929e8 [0167.322] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc) returned 0x4699d70 [0167.323] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc8) returned 0x469ca18 [0167.323] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699f98 [0167.323] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x40) returned 0x469e158 [0167.323] GetEnvironmentVariableA (in: lpName="MSCORDACWKS_DEBUG", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.323] GetEnvironmentVariableW (in: lpName="COMPlus_DbgDACSkipVerifyDlls", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.323] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca938 | out: phkResult=0xca938*=0x0) returned 0x2 [0167.323] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca934 | out: phkResult=0xca934*=0x160) returned 0x0 [0167.323] RegQueryValueExW (in: hKey=0x160, lpValueName="DbgDACSkipVerifyDlls", lpReserved=0x0, lpType=0xca93c, lpData=0xca91c, lpcbData=0xca92c*=0x4 | out: lpType=0xca93c*=0x0, lpData=0xca91c*=0x0, lpcbData=0xca92c*=0x4) returned 0x2 [0167.323] RegCloseKey (hKey=0x160) returned 0x0 [0167.323] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x4650000 [0167.324] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120000, lpBuffer=0x4650020, nSize=0x40, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650020*, lpNumberOfBytesRead=0xcaaf8*=0x40) returned 1 [0167.324] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cc8 [0167.324] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120130, lpBuffer=0x4650070, nSize=0xf8, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650070*, lpNumberOfBytesRead=0xcaaf8*=0xf8) returned 1 [0167.324] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ce0 [0167.324] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f1201d8, lpBuffer=0x4650180, nSize=0x8, lpNumberOfBytesRead=0xcaadc | out: lpBuffer=0x4650180*, lpNumberOfBytesRead=0xcaadc*=0x8) returned 1 [0167.324] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cf8 [0167.324] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f797894, lpBuffer=0x46501a0, nSize=0x1c, lpNumberOfBytesRead=0xcab18 | out: lpBuffer=0x46501a0*, lpNumberOfBytesRead=0xcab18*=0x1c) returned 1 [0167.324] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d28 [0167.324] GetLastError () returned 0xcb [0167.324] SetLastError (dwErrCode=0xcb) [0167.324] GetLastError () returned 0xcb [0167.324] SetLastError (dwErrCode=0xcb) [0167.324] GetLastError () returned 0xcb [0167.325] SetLastError (dwErrCode=0xcb) [0167.325] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f798138, lpBuffer=0x46501d0, nSize=0x4, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501d0*, lpNumberOfBytesRead=0xcafc8*=0x4) returned 1 [0167.325] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a040 [0167.325] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ab0, lpBuffer=0x46501f0, nSize=0x64, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501f0*, lpNumberOfBytesRead=0xcafc8*=0x64) returned 1 [0167.325] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fe0 [0167.325] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ad4, lpBuffer=0x4650270, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650270*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.325] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a028 [0167.325] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf9294c, lpBuffer=0x4650290, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650290*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.325] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ff8 [0167.325] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0xcb050, nSize=0x4, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0xcb050*, lpNumberOfBytesRead=0xcafbc*=0x4) returned 1 [0167.326] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0x46502b0, nSize=0x540, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0x46502b0*, lpNumberOfBytesRead=0xcafbc*=0x540) returned 1 [0167.326] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a010 [0167.326] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x200) returned 0x4692c28 [0167.326] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469e158 | out: hHeap=0x4690000) returned 1 [0167.326] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xe0146c, lpBuffer=0x4650800, nSize=0x4, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650800*, lpNumberOfBytesRead=0xcafb8*=0x4) returned 1 [0167.326] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a058 [0167.326] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732734, lpBuffer=0x4650820, nSize=0x50, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650820*, lpNumberOfBytesRead=0xcafb8*=0x50) returned 1 [0167.327] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a070 [0167.327] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f40, lpBuffer=0x4650880, nSize=0xc, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650880*, lpNumberOfBytesRead=0xcafb8*=0xc) returned 1 [0167.327] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fb0 [0167.327] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6e224448, lpBuffer=0x46508a0, nSize=0x28, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x46508a0*, lpNumberOfBytesRead=0xcafb8*=0x28) returned 1 [0167.327] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fc8 [0167.327] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f48, lpBuffer=0xcb130, nSize=0xb8, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb130*, lpNumberOfBytesRead=0xcb008*=0xb8) returned 1 [0167.327] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2733000, lpBuffer=0xcb1e8, nSize=0x1000, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb1e8*, lpNumberOfBytesRead=0xcb008*=0x1000) returned 1 [0167.327] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2734000, lpBuffer=0xcc1e8, nSize=0x538, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcc1e8*, lpNumberOfBytesRead=0xcb008*=0x538) returned 1 [0167.328] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d70 | out: hHeap=0x4690000) returned 1 [0167.328] VirtualFree (lpAddress=0x4650000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cc8 | out: hHeap=0x4690000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fe0 | out: hHeap=0x4690000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ce0 | out: hHeap=0x4690000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cf8 | out: hHeap=0x4690000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a040 | out: hHeap=0x4690000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a028 | out: hHeap=0x4690000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d28 | out: hHeap=0x4690000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ff8 | out: hHeap=0x4690000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a010 | out: hHeap=0x4690000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a058 | out: hHeap=0x4690000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a070 | out: hHeap=0x4690000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fb0 | out: hHeap=0x4690000) returned 1 [0167.330] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fc8 | out: hHeap=0x4690000) returned 1 [0167.331] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692c28 | out: hHeap=0x4690000) returned 1 [0167.331] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699f98 | out: hHeap=0x4690000) returned 1 [0167.331] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469ca18 | out: hHeap=0x4690000) returned 1 [0167.331] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46929e8 | out: hHeap=0x4690000) returned 1 [0167.331] OutOfProcessExceptionEventSignatureCallback () returned 0x0 [0167.331] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0167.332] GetProcAddress (hModule=0x770a0000, lpProcName="GetProcessIdOfThread") returned 0x770bfbd0 [0167.332] GetProcAddress (hModule=0x770a0000, lpProcName="GetThreadId") returned 0x770e11c0 [0167.332] GetProcessIdOfThread (Thread=0x710) returned 0x12ec [0167.332] GetThreadId (Thread=0x710) returned 0x12e4 [0167.332] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x18) returned 0x4692928 [0167.332] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc) returned 0x4699d70 [0167.332] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc8) returned 0x469c2c8 [0167.332] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699f98 [0167.332] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x40) returned 0x469dd20 [0167.332] GetEnvironmentVariableA (in: lpName="MSCORDACWKS_DEBUG", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.332] GetEnvironmentVariableW (in: lpName="COMPlus_DbgDACSkipVerifyDlls", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.332] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca938 | out: phkResult=0xca938*=0x0) returned 0x2 [0167.333] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca934 | out: phkResult=0xca934*=0x160) returned 0x0 [0167.333] RegQueryValueExW (in: hKey=0x160, lpValueName="DbgDACSkipVerifyDlls", lpReserved=0x0, lpType=0xca93c, lpData=0xca91c, lpcbData=0xca92c*=0x4 | out: lpType=0xca93c*=0x0, lpData=0xca91c*=0x0, lpcbData=0xca92c*=0x4) returned 0x2 [0167.333] RegCloseKey (hKey=0x160) returned 0x0 [0167.333] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x4650000 [0167.333] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120000, lpBuffer=0x4650020, nSize=0x40, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650020*, lpNumberOfBytesRead=0xcaaf8*=0x40) returned 1 [0167.333] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cc8 [0167.333] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120130, lpBuffer=0x4650070, nSize=0xf8, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650070*, lpNumberOfBytesRead=0xcaaf8*=0xf8) returned 1 [0167.334] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ce0 [0167.334] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f1201d8, lpBuffer=0x4650180, nSize=0x8, lpNumberOfBytesRead=0xcaadc | out: lpBuffer=0x4650180*, lpNumberOfBytesRead=0xcaadc*=0x8) returned 1 [0167.334] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cf8 [0167.334] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f797894, lpBuffer=0x46501a0, nSize=0x1c, lpNumberOfBytesRead=0xcab18 | out: lpBuffer=0x46501a0*, lpNumberOfBytesRead=0xcab18*=0x1c) returned 1 [0167.334] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d28 [0167.334] GetLastError () returned 0xcb [0167.334] SetLastError (dwErrCode=0xcb) [0167.334] GetLastError () returned 0xcb [0167.334] SetLastError (dwErrCode=0xcb) [0167.334] GetLastError () returned 0xcb [0167.334] SetLastError (dwErrCode=0xcb) [0167.334] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f798138, lpBuffer=0x46501d0, nSize=0x4, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501d0*, lpNumberOfBytesRead=0xcafc8*=0x4) returned 1 [0167.335] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ff8 [0167.335] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ab0, lpBuffer=0x46501f0, nSize=0x64, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501f0*, lpNumberOfBytesRead=0xcafc8*=0x64) returned 1 [0167.335] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a010 [0167.335] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ad4, lpBuffer=0x4650270, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650270*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.335] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a058 [0167.335] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf9294c, lpBuffer=0x4650290, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650290*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.335] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fb0 [0167.336] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0xcb050, nSize=0x4, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0xcb050*, lpNumberOfBytesRead=0xcafbc*=0x4) returned 1 [0167.336] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0x46502b0, nSize=0x540, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0x46502b0*, lpNumberOfBytesRead=0xcafbc*=0x540) returned 1 [0167.336] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a070 [0167.336] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x200) returned 0x4692c28 [0167.336] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469dd20 | out: hHeap=0x4690000) returned 1 [0167.336] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xe0146c, lpBuffer=0x4650800, nSize=0x4, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650800*, lpNumberOfBytesRead=0xcafb8*=0x4) returned 1 [0167.337] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fe0 [0167.337] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732734, lpBuffer=0x4650820, nSize=0x50, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650820*, lpNumberOfBytesRead=0xcafb8*=0x50) returned 1 [0167.337] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fc8 [0167.337] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f40, lpBuffer=0x4650880, nSize=0xc, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650880*, lpNumberOfBytesRead=0xcafb8*=0xc) returned 1 [0167.337] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a028 [0167.337] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6e224448, lpBuffer=0x46508a0, nSize=0x28, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x46508a0*, lpNumberOfBytesRead=0xcafb8*=0x28) returned 1 [0167.337] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a040 [0167.337] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f48, lpBuffer=0xcb130, nSize=0xb8, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb130*, lpNumberOfBytesRead=0xcb008*=0xb8) returned 1 [0167.337] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2733000, lpBuffer=0xcb1e8, nSize=0x1000, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb1e8*, lpNumberOfBytesRead=0xcb008*=0x1000) returned 1 [0167.337] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2734000, lpBuffer=0xcc1e8, nSize=0x538, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcc1e8*, lpNumberOfBytesRead=0xcb008*=0x538) returned 1 [0167.338] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d70 | out: hHeap=0x4690000) returned 1 [0167.338] VirtualFree (lpAddress=0x4650000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cc8 | out: hHeap=0x4690000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a010 | out: hHeap=0x4690000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ce0 | out: hHeap=0x4690000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cf8 | out: hHeap=0x4690000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ff8 | out: hHeap=0x4690000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a058 | out: hHeap=0x4690000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d28 | out: hHeap=0x4690000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fb0 | out: hHeap=0x4690000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a070 | out: hHeap=0x4690000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fe0 | out: hHeap=0x4690000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fc8 | out: hHeap=0x4690000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a028 | out: hHeap=0x4690000) returned 1 [0167.340] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a040 | out: hHeap=0x4690000) returned 1 [0167.341] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692c28 | out: hHeap=0x4690000) returned 1 [0167.341] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699f98 | out: hHeap=0x4690000) returned 1 [0167.341] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469c2c8 | out: hHeap=0x4690000) returned 1 [0167.341] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692928 | out: hHeap=0x4690000) returned 1 [0167.341] OutOfProcessExceptionEventSignatureCallback () returned 0x0 [0167.341] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0167.341] GetProcAddress (hModule=0x770a0000, lpProcName="GetProcessIdOfThread") returned 0x770bfbd0 [0167.342] GetProcAddress (hModule=0x770a0000, lpProcName="GetThreadId") returned 0x770e11c0 [0167.342] GetProcessIdOfThread (Thread=0x710) returned 0x12ec [0167.342] GetThreadId (Thread=0x710) returned 0x12e4 [0167.342] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x18) returned 0x4692b88 [0167.342] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc) returned 0x4699cf8 [0167.342] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc8) returned 0x469c2c8 [0167.342] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d28 [0167.342] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x40) returned 0x469de88 [0167.342] GetEnvironmentVariableA (in: lpName="MSCORDACWKS_DEBUG", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.342] GetEnvironmentVariableW (in: lpName="COMPlus_DbgDACSkipVerifyDlls", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.342] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca938 | out: phkResult=0xca938*=0x0) returned 0x2 [0167.343] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca934 | out: phkResult=0xca934*=0x160) returned 0x0 [0167.343] RegQueryValueExW (in: hKey=0x160, lpValueName="DbgDACSkipVerifyDlls", lpReserved=0x0, lpType=0xca93c, lpData=0xca91c, lpcbData=0xca92c*=0x4 | out: lpType=0xca93c*=0x0, lpData=0xca91c*=0x0, lpcbData=0xca92c*=0x4) returned 0x2 [0167.343] RegCloseKey (hKey=0x160) returned 0x0 [0167.343] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x4650000 [0167.343] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120000, lpBuffer=0x4650020, nSize=0x40, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650020*, lpNumberOfBytesRead=0xcaaf8*=0x40) returned 1 [0167.343] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cc8 [0167.343] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120130, lpBuffer=0x4650070, nSize=0xf8, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650070*, lpNumberOfBytesRead=0xcaaf8*=0xf8) returned 1 [0167.344] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699f98 [0167.344] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f1201d8, lpBuffer=0x4650180, nSize=0x8, lpNumberOfBytesRead=0xcaadc | out: lpBuffer=0x4650180*, lpNumberOfBytesRead=0xcaadc*=0x8) returned 1 [0167.344] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ce0 [0167.344] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f797894, lpBuffer=0x46501a0, nSize=0x1c, lpNumberOfBytesRead=0xcab18 | out: lpBuffer=0x46501a0*, lpNumberOfBytesRead=0xcab18*=0x1c) returned 1 [0167.344] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d70 [0167.344] GetLastError () returned 0xcb [0167.344] SetLastError (dwErrCode=0xcb) [0167.344] GetLastError () returned 0xcb [0167.344] SetLastError (dwErrCode=0xcb) [0167.344] GetLastError () returned 0xcb [0167.344] SetLastError (dwErrCode=0xcb) [0167.344] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f798138, lpBuffer=0x46501d0, nSize=0x4, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501d0*, lpNumberOfBytesRead=0xcafc8*=0x4) returned 1 [0167.344] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a070 [0167.344] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ab0, lpBuffer=0x46501f0, nSize=0x64, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501f0*, lpNumberOfBytesRead=0xcafc8*=0x64) returned 1 [0167.345] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a040 [0167.345] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ad4, lpBuffer=0x4650270, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650270*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.346] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a028 [0167.346] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf9294c, lpBuffer=0x4650290, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650290*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.346] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fe0 [0167.346] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0xcb050, nSize=0x4, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0xcb050*, lpNumberOfBytesRead=0xcafbc*=0x4) returned 1 [0167.346] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0x46502b0, nSize=0x540, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0x46502b0*, lpNumberOfBytesRead=0xcafbc*=0x540) returned 1 [0167.346] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ff8 [0167.346] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x200) returned 0x4692c28 [0167.347] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469de88 | out: hHeap=0x4690000) returned 1 [0167.347] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xe0146c, lpBuffer=0x4650800, nSize=0x4, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650800*, lpNumberOfBytesRead=0xcafb8*=0x4) returned 1 [0167.347] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a058 [0167.347] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732734, lpBuffer=0x4650820, nSize=0x50, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650820*, lpNumberOfBytesRead=0xcafb8*=0x50) returned 1 [0167.348] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a010 [0167.348] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f40, lpBuffer=0x4650880, nSize=0xc, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650880*, lpNumberOfBytesRead=0xcafb8*=0xc) returned 1 [0167.348] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fb0 [0167.348] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6e224448, lpBuffer=0x46508a0, nSize=0x28, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x46508a0*, lpNumberOfBytesRead=0xcafb8*=0x28) returned 1 [0167.348] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fc8 [0167.348] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f48, lpBuffer=0xcb130, nSize=0xb8, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb130*, lpNumberOfBytesRead=0xcb008*=0xb8) returned 1 [0167.348] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2733000, lpBuffer=0xcb1e8, nSize=0x1000, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb1e8*, lpNumberOfBytesRead=0xcb008*=0x1000) returned 1 [0167.348] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2734000, lpBuffer=0xcc1e8, nSize=0x538, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcc1e8*, lpNumberOfBytesRead=0xcb008*=0x538) returned 1 [0167.349] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cf8 | out: hHeap=0x4690000) returned 1 [0167.349] VirtualFree (lpAddress=0x4650000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.353] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cc8 | out: hHeap=0x4690000) returned 1 [0167.353] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a040 | out: hHeap=0x4690000) returned 1 [0167.353] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699f98 | out: hHeap=0x4690000) returned 1 [0167.353] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ce0 | out: hHeap=0x4690000) returned 1 [0167.353] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a070 | out: hHeap=0x4690000) returned 1 [0167.353] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a028 | out: hHeap=0x4690000) returned 1 [0167.353] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d70 | out: hHeap=0x4690000) returned 1 [0167.353] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fe0 | out: hHeap=0x4690000) returned 1 [0167.353] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ff8 | out: hHeap=0x4690000) returned 1 [0167.353] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a058 | out: hHeap=0x4690000) returned 1 [0167.353] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a010 | out: hHeap=0x4690000) returned 1 [0167.354] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fb0 | out: hHeap=0x4690000) returned 1 [0167.354] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fc8 | out: hHeap=0x4690000) returned 1 [0167.354] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692c28 | out: hHeap=0x4690000) returned 1 [0167.354] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d28 | out: hHeap=0x4690000) returned 1 [0167.355] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469c2c8 | out: hHeap=0x4690000) returned 1 [0167.355] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692b88 | out: hHeap=0x4690000) returned 1 [0167.355] OutOfProcessExceptionEventSignatureCallback () returned 0x0 [0167.355] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0167.355] GetProcAddress (hModule=0x770a0000, lpProcName="GetProcessIdOfThread") returned 0x770bfbd0 [0167.355] GetProcAddress (hModule=0x770a0000, lpProcName="GetThreadId") returned 0x770e11c0 [0167.355] GetProcessIdOfThread (Thread=0x710) returned 0x12ec [0167.355] GetThreadId (Thread=0x710) returned 0x12e4 [0167.356] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x18) returned 0x4692a88 [0167.356] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc) returned 0x4699d70 [0167.356] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc8) returned 0x469c398 [0167.356] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d28 [0167.356] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x40) returned 0x469e1a0 [0167.356] GetEnvironmentVariableA (in: lpName="MSCORDACWKS_DEBUG", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.356] GetEnvironmentVariableW (in: lpName="COMPlus_DbgDACSkipVerifyDlls", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.356] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca938 | out: phkResult=0xca938*=0x0) returned 0x2 [0167.356] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca934 | out: phkResult=0xca934*=0x160) returned 0x0 [0167.356] RegQueryValueExW (in: hKey=0x160, lpValueName="DbgDACSkipVerifyDlls", lpReserved=0x0, lpType=0xca93c, lpData=0xca91c, lpcbData=0xca92c*=0x4 | out: lpType=0xca93c*=0x0, lpData=0xca91c*=0x0, lpcbData=0xca92c*=0x4) returned 0x2 [0167.356] RegCloseKey (hKey=0x160) returned 0x0 [0167.356] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x4650000 [0167.357] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120000, lpBuffer=0x4650020, nSize=0x40, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650020*, lpNumberOfBytesRead=0xcaaf8*=0x40) returned 1 [0167.357] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699f98 [0167.357] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120130, lpBuffer=0x4650070, nSize=0xf8, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650070*, lpNumberOfBytesRead=0xcaaf8*=0xf8) returned 1 [0167.357] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cc8 [0167.357] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f1201d8, lpBuffer=0x4650180, nSize=0x8, lpNumberOfBytesRead=0xcaadc | out: lpBuffer=0x4650180*, lpNumberOfBytesRead=0xcaadc*=0x8) returned 1 [0167.357] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ce0 [0167.357] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f797894, lpBuffer=0x46501a0, nSize=0x1c, lpNumberOfBytesRead=0xcab18 | out: lpBuffer=0x46501a0*, lpNumberOfBytesRead=0xcab18*=0x1c) returned 1 [0167.357] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cf8 [0167.357] GetLastError () returned 0xcb [0167.358] SetLastError (dwErrCode=0xcb) [0167.358] GetLastError () returned 0xcb [0167.358] SetLastError (dwErrCode=0xcb) [0167.358] GetLastError () returned 0xcb [0167.358] SetLastError (dwErrCode=0xcb) [0167.358] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f798138, lpBuffer=0x46501d0, nSize=0x4, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501d0*, lpNumberOfBytesRead=0xcafc8*=0x4) returned 1 [0167.358] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fe0 [0167.358] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ab0, lpBuffer=0x46501f0, nSize=0x64, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501f0*, lpNumberOfBytesRead=0xcafc8*=0x64) returned 1 [0167.358] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a040 [0167.358] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ad4, lpBuffer=0x4650270, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650270*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.358] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a058 [0167.358] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf9294c, lpBuffer=0x4650290, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650290*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.359] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fc8 [0167.359] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0xcb050, nSize=0x4, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0xcb050*, lpNumberOfBytesRead=0xcafbc*=0x4) returned 1 [0167.359] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0x46502b0, nSize=0x540, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0x46502b0*, lpNumberOfBytesRead=0xcafbc*=0x540) returned 1 [0167.359] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a028 [0167.359] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x200) returned 0x4692c28 [0167.359] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469e1a0 | out: hHeap=0x4690000) returned 1 [0167.359] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xe0146c, lpBuffer=0x4650800, nSize=0x4, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650800*, lpNumberOfBytesRead=0xcafb8*=0x4) returned 1 [0167.360] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fb0 [0167.360] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732734, lpBuffer=0x4650820, nSize=0x50, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650820*, lpNumberOfBytesRead=0xcafb8*=0x50) returned 1 [0167.360] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a070 [0167.360] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f40, lpBuffer=0x4650880, nSize=0xc, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650880*, lpNumberOfBytesRead=0xcafb8*=0xc) returned 1 [0167.360] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ff8 [0167.360] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6e224448, lpBuffer=0x46508a0, nSize=0x28, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x46508a0*, lpNumberOfBytesRead=0xcafb8*=0x28) returned 1 [0167.360] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a010 [0167.360] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f48, lpBuffer=0xcb130, nSize=0xb8, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb130*, lpNumberOfBytesRead=0xcb008*=0xb8) returned 1 [0167.360] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2733000, lpBuffer=0xcb1e8, nSize=0x1000, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb1e8*, lpNumberOfBytesRead=0xcb008*=0x1000) returned 1 [0167.361] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2734000, lpBuffer=0xcc1e8, nSize=0x538, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcc1e8*, lpNumberOfBytesRead=0xcb008*=0x538) returned 1 [0167.361] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d70 | out: hHeap=0x4690000) returned 1 [0167.361] VirtualFree (lpAddress=0x4650000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.363] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699f98 | out: hHeap=0x4690000) returned 1 [0167.363] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a040 | out: hHeap=0x4690000) returned 1 [0167.363] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cc8 | out: hHeap=0x4690000) returned 1 [0167.363] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ce0 | out: hHeap=0x4690000) returned 1 [0167.363] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fe0 | out: hHeap=0x4690000) returned 1 [0167.363] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a058 | out: hHeap=0x4690000) returned 1 [0167.363] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cf8 | out: hHeap=0x4690000) returned 1 [0167.363] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fc8 | out: hHeap=0x4690000) returned 1 [0167.363] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a028 | out: hHeap=0x4690000) returned 1 [0167.364] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fb0 | out: hHeap=0x4690000) returned 1 [0167.364] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a070 | out: hHeap=0x4690000) returned 1 [0167.364] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ff8 | out: hHeap=0x4690000) returned 1 [0167.364] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a010 | out: hHeap=0x4690000) returned 1 [0167.364] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692c28 | out: hHeap=0x4690000) returned 1 [0167.364] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d28 | out: hHeap=0x4690000) returned 1 [0167.364] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469c398 | out: hHeap=0x4690000) returned 1 [0167.364] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692a88 | out: hHeap=0x4690000) returned 1 [0167.364] OutOfProcessExceptionEventSignatureCallback () returned 0x0 [0167.365] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0167.365] GetProcAddress (hModule=0x770a0000, lpProcName="GetProcessIdOfThread") returned 0x770bfbd0 [0167.365] GetProcAddress (hModule=0x770a0000, lpProcName="GetThreadId") returned 0x770e11c0 [0167.365] GetProcessIdOfThread (Thread=0x710) returned 0x12ec [0167.365] GetThreadId (Thread=0x710) returned 0x12e4 [0167.366] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x18) returned 0x4692a48 [0167.366] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc) returned 0x4699f98 [0167.366] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc8) returned 0x469c6d8 [0167.366] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cc8 [0167.366] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x40) returned 0x469e158 [0167.366] GetEnvironmentVariableA (in: lpName="MSCORDACWKS_DEBUG", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.367] GetEnvironmentVariableW (in: lpName="COMPlus_DbgDACSkipVerifyDlls", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.367] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca938 | out: phkResult=0xca938*=0x0) returned 0x2 [0167.367] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca934 | out: phkResult=0xca934*=0x160) returned 0x0 [0167.367] RegQueryValueExW (in: hKey=0x160, lpValueName="DbgDACSkipVerifyDlls", lpReserved=0x0, lpType=0xca93c, lpData=0xca91c, lpcbData=0xca92c*=0x4 | out: lpType=0xca93c*=0x0, lpData=0xca91c*=0x0, lpcbData=0xca92c*=0x4) returned 0x2 [0167.367] RegCloseKey (hKey=0x160) returned 0x0 [0167.367] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x4650000 [0167.367] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120000, lpBuffer=0x4650020, nSize=0x40, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650020*, lpNumberOfBytesRead=0xcaaf8*=0x40) returned 1 [0167.367] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ce0 [0167.368] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120130, lpBuffer=0x4650070, nSize=0xf8, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650070*, lpNumberOfBytesRead=0xcaaf8*=0xf8) returned 1 [0167.368] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d28 [0167.368] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f1201d8, lpBuffer=0x4650180, nSize=0x8, lpNumberOfBytesRead=0xcaadc | out: lpBuffer=0x4650180*, lpNumberOfBytesRead=0xcaadc*=0x8) returned 1 [0167.368] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cf8 [0167.368] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f797894, lpBuffer=0x46501a0, nSize=0x1c, lpNumberOfBytesRead=0xcab18 | out: lpBuffer=0x46501a0*, lpNumberOfBytesRead=0xcab18*=0x1c) returned 1 [0167.368] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d70 [0167.368] GetLastError () returned 0xcb [0167.368] SetLastError (dwErrCode=0xcb) [0167.368] GetLastError () returned 0xcb [0167.368] SetLastError (dwErrCode=0xcb) [0167.368] GetLastError () returned 0xcb [0167.368] SetLastError (dwErrCode=0xcb) [0167.369] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f798138, lpBuffer=0x46501d0, nSize=0x4, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501d0*, lpNumberOfBytesRead=0xcafc8*=0x4) returned 1 [0167.369] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a010 [0167.369] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ab0, lpBuffer=0x46501f0, nSize=0x64, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501f0*, lpNumberOfBytesRead=0xcafc8*=0x64) returned 1 [0167.369] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a070 [0167.369] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ad4, lpBuffer=0x4650270, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650270*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.369] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a058 [0167.369] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf9294c, lpBuffer=0x4650290, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650290*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.369] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fb0 [0167.369] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0xcb050, nSize=0x4, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0xcb050*, lpNumberOfBytesRead=0xcafbc*=0x4) returned 1 [0167.369] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0x46502b0, nSize=0x540, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0x46502b0*, lpNumberOfBytesRead=0xcafbc*=0x540) returned 1 [0167.370] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a028 [0167.370] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x200) returned 0x4692c28 [0167.370] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469e158 | out: hHeap=0x4690000) returned 1 [0167.370] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xe0146c, lpBuffer=0x4650800, nSize=0x4, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650800*, lpNumberOfBytesRead=0xcafb8*=0x4) returned 1 [0167.370] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fc8 [0167.370] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732734, lpBuffer=0x4650820, nSize=0x50, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650820*, lpNumberOfBytesRead=0xcafb8*=0x50) returned 1 [0167.370] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fe0 [0167.371] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f40, lpBuffer=0x4650880, nSize=0xc, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650880*, lpNumberOfBytesRead=0xcafb8*=0xc) returned 1 [0167.371] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ff8 [0167.371] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6e224448, lpBuffer=0x46508a0, nSize=0x28, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x46508a0*, lpNumberOfBytesRead=0xcafb8*=0x28) returned 1 [0167.371] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a040 [0167.371] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f48, lpBuffer=0xcb130, nSize=0xb8, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb130*, lpNumberOfBytesRead=0xcb008*=0xb8) returned 1 [0167.371] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2733000, lpBuffer=0xcb1e8, nSize=0x1000, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb1e8*, lpNumberOfBytesRead=0xcb008*=0x1000) returned 1 [0167.371] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2734000, lpBuffer=0xcc1e8, nSize=0x538, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcc1e8*, lpNumberOfBytesRead=0xcb008*=0x538) returned 1 [0167.371] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699f98 | out: hHeap=0x4690000) returned 1 [0167.371] VirtualFree (lpAddress=0x4650000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ce0 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a070 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d28 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cf8 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a010 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a058 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d70 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fb0 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a028 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fc8 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fe0 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ff8 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a040 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692c28 | out: hHeap=0x4690000) returned 1 [0167.374] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cc8 | out: hHeap=0x4690000) returned 1 [0167.375] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469c6d8 | out: hHeap=0x4690000) returned 1 [0167.375] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692a48 | out: hHeap=0x4690000) returned 1 [0167.375] OutOfProcessExceptionEventSignatureCallback () returned 0x0 [0167.375] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0167.375] GetProcAddress (hModule=0x770a0000, lpProcName="GetProcessIdOfThread") returned 0x770bfbd0 [0167.375] GetProcAddress (hModule=0x770a0000, lpProcName="GetThreadId") returned 0x770e11c0 [0167.375] GetProcessIdOfThread (Thread=0x710) returned 0x12ec [0167.375] GetThreadId (Thread=0x710) returned 0x12e4 [0167.376] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x18) returned 0x4692988 [0167.376] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc) returned 0x4699ce0 [0167.376] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc8) returned 0x469c2c8 [0167.376] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699f98 [0167.376] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x40) returned 0x469e470 [0167.376] GetEnvironmentVariableA (in: lpName="MSCORDACWKS_DEBUG", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.376] GetEnvironmentVariableW (in: lpName="COMPlus_DbgDACSkipVerifyDlls", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.376] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca938 | out: phkResult=0xca938*=0x0) returned 0x2 [0167.376] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca934 | out: phkResult=0xca934*=0x160) returned 0x0 [0167.376] RegQueryValueExW (in: hKey=0x160, lpValueName="DbgDACSkipVerifyDlls", lpReserved=0x0, lpType=0xca93c, lpData=0xca91c, lpcbData=0xca92c*=0x4 | out: lpType=0xca93c*=0x0, lpData=0xca91c*=0x0, lpcbData=0xca92c*=0x4) returned 0x2 [0167.376] RegCloseKey (hKey=0x160) returned 0x0 [0167.376] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x4650000 [0167.377] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120000, lpBuffer=0x4650020, nSize=0x40, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650020*, lpNumberOfBytesRead=0xcaaf8*=0x40) returned 1 [0167.377] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cc8 [0167.377] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120130, lpBuffer=0x4650070, nSize=0xf8, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650070*, lpNumberOfBytesRead=0xcaaf8*=0xf8) returned 1 [0167.377] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d28 [0167.377] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f1201d8, lpBuffer=0x4650180, nSize=0x8, lpNumberOfBytesRead=0xcaadc | out: lpBuffer=0x4650180*, lpNumberOfBytesRead=0xcaadc*=0x8) returned 1 [0167.377] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cf8 [0167.377] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f797894, lpBuffer=0x46501a0, nSize=0x1c, lpNumberOfBytesRead=0xcab18 | out: lpBuffer=0x46501a0*, lpNumberOfBytesRead=0xcab18*=0x1c) returned 1 [0167.377] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d70 [0167.377] GetLastError () returned 0xcb [0167.377] SetLastError (dwErrCode=0xcb) [0167.377] GetLastError () returned 0xcb [0167.377] SetLastError (dwErrCode=0xcb) [0167.377] GetLastError () returned 0xcb [0167.378] SetLastError (dwErrCode=0xcb) [0167.378] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f798138, lpBuffer=0x46501d0, nSize=0x4, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501d0*, lpNumberOfBytesRead=0xcafc8*=0x4) returned 1 [0167.378] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a028 [0167.378] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ab0, lpBuffer=0x46501f0, nSize=0x64, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501f0*, lpNumberOfBytesRead=0xcafc8*=0x64) returned 1 [0167.378] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a058 [0167.378] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ad4, lpBuffer=0x4650270, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650270*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.378] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a040 [0167.378] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf9294c, lpBuffer=0x4650290, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650290*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.378] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a070 [0167.378] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0xcb050, nSize=0x4, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0xcb050*, lpNumberOfBytesRead=0xcafbc*=0x4) returned 1 [0167.378] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0x46502b0, nSize=0x540, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0x46502b0*, lpNumberOfBytesRead=0xcafbc*=0x540) returned 1 [0167.379] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fb0 [0167.379] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x200) returned 0x4692c28 [0167.379] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469e470 | out: hHeap=0x4690000) returned 1 [0167.379] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xe0146c, lpBuffer=0x4650800, nSize=0x4, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650800*, lpNumberOfBytesRead=0xcafb8*=0x4) returned 1 [0167.379] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ff8 [0167.379] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732734, lpBuffer=0x4650820, nSize=0x50, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650820*, lpNumberOfBytesRead=0xcafb8*=0x50) returned 1 [0167.379] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fc8 [0167.379] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f40, lpBuffer=0x4650880, nSize=0xc, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650880*, lpNumberOfBytesRead=0xcafb8*=0xc) returned 1 [0167.379] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fe0 [0167.380] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6e224448, lpBuffer=0x46508a0, nSize=0x28, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x46508a0*, lpNumberOfBytesRead=0xcafb8*=0x28) returned 1 [0167.380] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a010 [0167.380] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f48, lpBuffer=0xcb130, nSize=0xb8, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb130*, lpNumberOfBytesRead=0xcb008*=0xb8) returned 1 [0167.380] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2733000, lpBuffer=0xcb1e8, nSize=0x1000, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb1e8*, lpNumberOfBytesRead=0xcb008*=0x1000) returned 1 [0167.380] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2734000, lpBuffer=0xcc1e8, nSize=0x538, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcc1e8*, lpNumberOfBytesRead=0xcb008*=0x538) returned 1 [0167.380] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ce0 | out: hHeap=0x4690000) returned 1 [0167.380] VirtualFree (lpAddress=0x4650000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.382] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cc8 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a058 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d28 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cf8 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a028 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a040 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d70 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a070 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fb0 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ff8 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fc8 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fe0 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a010 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692c28 | out: hHeap=0x4690000) returned 1 [0167.383] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699f98 | out: hHeap=0x4690000) returned 1 [0167.384] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469c2c8 | out: hHeap=0x4690000) returned 1 [0167.384] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692988 | out: hHeap=0x4690000) returned 1 [0167.384] OutOfProcessExceptionEventSignatureCallback () returned 0x0 [0167.384] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x770a0000 [0167.384] GetProcAddress (hModule=0x770a0000, lpProcName="GetProcessIdOfThread") returned 0x770bfbd0 [0167.384] GetProcAddress (hModule=0x770a0000, lpProcName="GetThreadId") returned 0x770e11c0 [0167.384] GetProcessIdOfThread (Thread=0x710) returned 0x12ec [0167.385] GetThreadId (Thread=0x710) returned 0x12e4 [0167.385] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x18) returned 0x46929e8 [0167.385] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc) returned 0x4699f98 [0167.385] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0xc8) returned 0x469beb8 [0167.385] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d70 [0167.385] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x40) returned 0x469e3e0 [0167.385] GetEnvironmentVariableA (in: lpName="MSCORDACWKS_DEBUG", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.385] GetEnvironmentVariableW (in: lpName="COMPlus_DbgDACSkipVerifyDlls", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0x0 [0167.385] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca938 | out: phkResult=0xca938*=0x0) returned 0x2 [0167.385] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0xca934 | out: phkResult=0xca934*=0x160) returned 0x0 [0167.385] RegQueryValueExW (in: hKey=0x160, lpValueName="DbgDACSkipVerifyDlls", lpReserved=0x0, lpType=0xca93c, lpData=0xca91c, lpcbData=0xca92c*=0x4 | out: lpType=0xca93c*=0x0, lpData=0xca91c*=0x0, lpcbData=0xca92c*=0x4) returned 0x2 [0167.385] RegCloseKey (hKey=0x160) returned 0x0 [0167.385] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x1000, flProtect=0x4) returned 0x4650000 [0167.386] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120000, lpBuffer=0x4650020, nSize=0x40, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650020*, lpNumberOfBytesRead=0xcaaf8*=0x40) returned 1 [0167.386] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cc8 [0167.386] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f120130, lpBuffer=0x4650070, nSize=0xf8, lpNumberOfBytesRead=0xcaaf8 | out: lpBuffer=0x4650070*, lpNumberOfBytesRead=0xcaaf8*=0xf8) returned 1 [0167.386] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ce0 [0167.386] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f1201d8, lpBuffer=0x4650180, nSize=0x8, lpNumberOfBytesRead=0xcaadc | out: lpBuffer=0x4650180*, lpNumberOfBytesRead=0xcaadc*=0x8) returned 1 [0167.386] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699d28 [0167.386] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f797894, lpBuffer=0x46501a0, nSize=0x1c, lpNumberOfBytesRead=0xcab18 | out: lpBuffer=0x46501a0*, lpNumberOfBytesRead=0xcab18*=0x1c) returned 1 [0167.386] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699cf8 [0167.386] GetLastError () returned 0xcb [0167.387] SetLastError (dwErrCode=0xcb) [0167.387] GetLastError () returned 0xcb [0167.387] SetLastError (dwErrCode=0xcb) [0167.387] GetLastError () returned 0xcb [0167.387] SetLastError (dwErrCode=0xcb) [0167.387] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6f798138, lpBuffer=0x46501d0, nSize=0x4, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501d0*, lpNumberOfBytesRead=0xcafc8*=0x4) returned 1 [0167.387] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fe0 [0167.387] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ab0, lpBuffer=0x46501f0, nSize=0x64, lpNumberOfBytesRead=0xcafc8 | out: lpBuffer=0x46501f0*, lpNumberOfBytesRead=0xcafc8*=0x64) returned 1 [0167.387] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a028 [0167.387] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf81ad4, lpBuffer=0x4650270, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650270*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.387] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fc8 [0167.387] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf9294c, lpBuffer=0x4650290, nSize=0x4, lpNumberOfBytesRead=0xcafc4 | out: lpBuffer=0x4650290*, lpNumberOfBytesRead=0xcafc4*=0x4) returned 1 [0167.388] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a058 [0167.388] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0xcb050, nSize=0x4, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0xcb050*, lpNumberOfBytesRead=0xcafbc*=0x4) returned 1 [0167.388] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xf92868, lpBuffer=0x46502b0, nSize=0x540, lpNumberOfBytesRead=0xcafbc | out: lpBuffer=0x46502b0*, lpNumberOfBytesRead=0xcafbc*=0x540) returned 1 [0167.388] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699fb0 [0167.388] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x200) returned 0x4692c28 [0167.389] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469e3e0 | out: hHeap=0x4690000) returned 1 [0167.389] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0xe0146c, lpBuffer=0x4650800, nSize=0x4, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650800*, lpNumberOfBytesRead=0xcafb8*=0x4) returned 1 [0167.389] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x4699ff8 [0167.389] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732734, lpBuffer=0x4650820, nSize=0x50, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650820*, lpNumberOfBytesRead=0xcafb8*=0x50) returned 1 [0167.389] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a010 [0167.389] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f40, lpBuffer=0x4650880, nSize=0xc, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x4650880*, lpNumberOfBytesRead=0xcafb8*=0xc) returned 1 [0167.389] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a040 [0167.389] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x6e224448, lpBuffer=0x46508a0, nSize=0x28, lpNumberOfBytesRead=0xcafb8 | out: lpBuffer=0x46508a0*, lpNumberOfBytesRead=0xcafb8*=0x28) returned 1 [0167.389] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x0, Size=0x10) returned 0x469a070 [0167.389] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2732f48, lpBuffer=0xcb130, nSize=0xb8, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb130*, lpNumberOfBytesRead=0xcb008*=0xb8) returned 1 [0167.390] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2733000, lpBuffer=0xcb1e8, nSize=0x1000, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcb1e8*, lpNumberOfBytesRead=0xcb008*=0x1000) returned 1 [0167.390] ReadProcessMemory (in: hProcess=0x714, lpBaseAddress=0x2734000, lpBuffer=0xcc1e8, nSize=0x538, lpNumberOfBytesRead=0xcb008 | out: lpBuffer=0xcc1e8*, lpNumberOfBytesRead=0xcb008*=0x538) returned 1 [0167.390] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699f98 | out: hHeap=0x4690000) returned 1 [0167.390] VirtualFree (lpAddress=0x4650000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.392] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cc8 | out: hHeap=0x4690000) returned 1 [0167.392] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a028 | out: hHeap=0x4690000) returned 1 [0167.392] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ce0 | out: hHeap=0x4690000) returned 1 [0167.392] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d28 | out: hHeap=0x4690000) returned 1 [0167.392] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fe0 | out: hHeap=0x4690000) returned 1 [0167.392] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fc8 | out: hHeap=0x4690000) returned 1 [0167.392] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699cf8 | out: hHeap=0x4690000) returned 1 [0167.393] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a058 | out: hHeap=0x4690000) returned 1 [0167.393] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699fb0 | out: hHeap=0x4690000) returned 1 [0167.393] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ff8 | out: hHeap=0x4690000) returned 1 [0167.393] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a010 | out: hHeap=0x4690000) returned 1 [0167.393] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a040 | out: hHeap=0x4690000) returned 1 [0167.393] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a070 | out: hHeap=0x4690000) returned 1 [0167.393] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692c28 | out: hHeap=0x4690000) returned 1 [0167.393] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699d70 | out: hHeap=0x4690000) returned 1 [0167.394] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469beb8 | out: hHeap=0x4690000) returned 1 [0167.394] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46929e8 | out: hHeap=0x4690000) returned 1 [0175.815] _DllMainCRTStartup () returned 0x1 [0175.827] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46a37c0 | out: hHeap=0x4690000) returned 1 [0175.827] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469dc38 | out: hHeap=0x4690000) returned 1 [0175.827] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4698140 | out: hHeap=0x4690000) returned 1 [0175.828] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469ffc8 | out: hHeap=0x4690000) returned 1 [0175.828] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699900 | out: hHeap=0x4690000) returned 1 [0175.828] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469df60 | out: hHeap=0x4690000) returned 1 [0175.829] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46938a8 | out: hHeap=0x4690000) returned 1 [0175.829] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692b28 | out: hHeap=0x4690000) returned 1 [0175.829] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4693368 | out: hHeap=0x4690000) returned 1 [0175.829] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699ea8 | out: hHeap=0x4690000) returned 1 [0175.829] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469da80 | out: hHeap=0x4690000) returned 1 [0175.829] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46934c0 | out: hHeap=0x4690000) returned 1 [0175.830] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692be8 | out: hHeap=0x4690000) returned 1 [0175.830] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469da30 | out: hHeap=0x4690000) returned 1 [0175.830] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46928e8 | out: hHeap=0x4690000) returned 1 [0175.830] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699f50 | out: hHeap=0x4690000) returned 1 [0175.830] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a160 | out: hHeap=0x4690000) returned 1 [0175.830] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469df18 | out: hHeap=0x4690000) returned 1 [0175.830] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469db48 | out: hHeap=0x4690000) returned 1 [0175.830] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469dc10 | out: hHeap=0x4690000) returned 1 [0175.831] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469a210 | out: hHeap=0x4690000) returned 1 [0175.831] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692948 | out: hHeap=0x4690000) returned 1 [0175.831] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692a28 | out: hHeap=0x4690000) returned 1 [0175.831] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469db70 | out: hHeap=0x4690000) returned 1 [0175.831] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699b40 | out: hHeap=0x4690000) returned 1 [0175.831] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4698178 | out: hHeap=0x4690000) returned 1 [0175.831] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469dbe8 | out: hHeap=0x4690000) returned 1 [0175.832] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4693500 | out: hHeap=0x4690000) returned 1 [0175.832] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692848 | out: hHeap=0x4690000) returned 1 [0175.832] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4699f68 | out: hHeap=0x4690000) returned 1 [0175.832] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692a68 | out: hHeap=0x4690000) returned 1 [0175.832] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46981b0 | out: hHeap=0x4690000) returned 1 [0175.833] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46981e8 | out: hHeap=0x4690000) returned 1 [0175.833] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692b08 | out: hHeap=0x4690000) returned 1 [0175.833] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46a2b80 | out: hHeap=0x4690000) returned 1 [0175.833] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692b48 | out: hHeap=0x4690000) returned 1 [0175.833] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46a2bb0 | out: hHeap=0x4690000) returned 1 [0175.833] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46929c8 | out: hHeap=0x4690000) returned 1 [0175.834] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46932c8 | out: hHeap=0x4690000) returned 1 [0175.834] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4693850 | out: hHeap=0x4690000) returned 1 [0175.834] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46a2be0 | out: hHeap=0x4690000) returned 1 [0175.835] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x46a2fb8 | out: hHeap=0x4690000) returned 1 [0175.835] _freefls () returned 0x1 [0175.835] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469fda0 | out: hHeap=0x4690000) returned 1 [0175.836] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x469f9d8 | out: hHeap=0x4690000) returned 1 [0175.836] _freefls () returned 0x1 [0175.836] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x478b840 | out: hHeap=0x4690000) returned 1 [0175.836] _freefls () returned 0x1 [0175.837] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x478e778 | out: hHeap=0x4690000) returned 1 [0175.837] _freefls () returned 0x1 [0175.837] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x6680048 | out: hHeap=0x4690000) returned 1 [0175.837] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4692c08 | out: hHeap=0x4690000) returned 1 Thread: id = 168 os_tid = 0x1218 Thread: id = 169 os_tid = 0x820 Thread: id = 170 os_tid = 0x1358 Thread: id = 172 os_tid = 0x137c [0169.409] _DllMainCRTStartup () returned 0x1 [0169.409] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x3bc) returned 0x478b840 [0169.409] GetCurrentThreadId () returned 0x137c Thread: id = 173 os_tid = 0x750 [0169.418] _DllMainCRTStartup () returned 0x1 [0169.418] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x3bc) returned 0x478e778 [0169.418] GetCurrentThreadId () returned 0x750 Thread: id = 174 os_tid = 0x1398 [0169.418] _DllMainCRTStartup () returned 0x1 [0169.419] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x3bc) returned 0x6680048 [0169.419] GetCurrentThreadId () returned 0x1398 Thread: id = 200 os_tid = 0x1318 [0169.711] _DllMainCRTStartup () returned 0x1 [0169.711] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x3bc) returned 0x66809f8 [0169.711] GetCurrentThreadId () returned 0x1318 [0175.800] _freefls () returned 0x1 [0175.801] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x66809f8 | out: hHeap=0x4690000) returned 1 [0175.801] _DllMainCRTStartup () returned 0x1 Thread: id = 201 os_tid = 0x108c [0169.790] _DllMainCRTStartup () returned 0x1 [0169.790] RtlAllocateHeap (HeapHandle=0x4690000, Flags=0x8, Size=0x3bc) returned 0x4789d40 [0169.791] GetCurrentThreadId () returned 0x108c [0175.792] _freefls () returned 0x1 [0175.793] HeapFree (in: hHeap=0x4690000, dwFlags=0x0, lpMem=0x4789d40 | out: hHeap=0x4690000) returned 1 [0175.793] _DllMainCRTStartup () returned 0x1 Process: id = "8" image_name = "aspnet_compiler.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_compiler.exe" page_root = "0x67bd8000" os_pid = "0x774" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x12ec" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\"" cur_dir = "C:\\Windows\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ebd3" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x76495000" os_pid = "0x364" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AJRouter" [0xa], "NT SERVICE\\bthserv" [0xa], "NT SERVICE\\CDPSvc" [0xa], "NT SERVICE\\EventSystem" [0xa], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\FontCache" [0xa], "NT SERVICE\\LicenseManager" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\PhoneSvc" [0xa], "NT SERVICE\\RemoteRegistry" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\tzautoupdate" [0xe], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT SERVICE\\workfolderssvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b84b" [0xc000000f], "LOCAL" [0x7] Region: id = 2369 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2370 start_va = 0x86e3c00000 end_va = 0x86e3dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e3c00000" filename = "" Region: id = 2371 start_va = 0x86e3e00000 end_va = 0x86e3e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e3e00000" filename = "" Region: id = 2372 start_va = 0x86e4000000 end_va = 0x86e40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e4000000" filename = "" Region: id = 2373 start_va = 0x86e4100000 end_va = 0x86e41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e4100000" filename = "" Region: id = 2374 start_va = 0x86e4200000 end_va = 0x86e42fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e4200000" filename = "" Region: id = 2375 start_va = 0x86e4500000 end_va = 0x86e457ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e4500000" filename = "" Region: id = 2376 start_va = 0x86e4680000 end_va = 0x86e477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e4680000" filename = "" Region: id = 2377 start_va = 0x86e4780000 end_va = 0x86e487ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e4780000" filename = "" Region: id = 2378 start_va = 0x86e4880000 end_va = 0x86e497ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e4880000" filename = "" Region: id = 2379 start_va = 0x86e4b80000 end_va = 0x86e4c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e4b80000" filename = "" Region: id = 2380 start_va = 0x86e4c80000 end_va = 0x86e4d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e4c80000" filename = "" Region: id = 2381 start_va = 0x86e4d80000 end_va = 0x86e4e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e4d80000" filename = "" Region: id = 2382 start_va = 0x86e4e80000 end_va = 0x86e4f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e4e80000" filename = "" Region: id = 2383 start_va = 0x86e4f80000 end_va = 0x86e507ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e4f80000" filename = "" Region: id = 2384 start_va = 0x86e5480000 end_va = 0x86e557ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e5480000" filename = "" Region: id = 2385 start_va = 0x86e5580000 end_va = 0x86e567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e5580000" filename = "" Region: id = 2386 start_va = 0x86e5680000 end_va = 0x86e577ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e5680000" filename = "" Region: id = 2387 start_va = 0x86e5780000 end_va = 0x86e587ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e5780000" filename = "" Region: id = 2388 start_va = 0x86e6000000 end_va = 0x86e60fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e6000000" filename = "" Region: id = 2389 start_va = 0x86e6400000 end_va = 0x86e64fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e6400000" filename = "" Region: id = 2390 start_va = 0x86e6500000 end_va = 0x86e65fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e6500000" filename = "" Region: id = 2391 start_va = 0x86e6680000 end_va = 0x86e677ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e6680000" filename = "" Region: id = 2392 start_va = 0x86e6780000 end_va = 0x86e687ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e6780000" filename = "" Region: id = 2393 start_va = 0x86e6880000 end_va = 0x86e697ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e6880000" filename = "" Region: id = 2394 start_va = 0x86e6980000 end_va = 0x86e6a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e6980000" filename = "" Region: id = 2395 start_va = 0x86e6b80000 end_va = 0x86e6c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e6b80000" filename = "" Region: id = 2396 start_va = 0x23631010000 end_va = 0x2363101ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023631010000" filename = "" Region: id = 2397 start_va = 0x23631020000 end_va = 0x23631020fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 2398 start_va = 0x23631030000 end_va = 0x23631044fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023631030000" filename = "" Region: id = 2399 start_va = 0x23631050000 end_va = 0x23631053fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023631050000" filename = "" Region: id = 2400 start_va = 0x23631060000 end_va = 0x23631060fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023631060000" filename = "" Region: id = 2401 start_va = 0x23631070000 end_va = 0x23631071fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023631070000" filename = "" Region: id = 2402 start_va = 0x23631080000 end_va = 0x2363113dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2403 start_va = 0x23631140000 end_va = 0x236311fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023631140000" filename = "" Region: id = 2404 start_va = 0x23631200000 end_va = 0x23631206fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023631200000" filename = "" Region: id = 2405 start_va = 0x23631210000 end_va = 0x23631210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023631210000" filename = "" Region: id = 2406 start_va = 0x23631220000 end_va = 0x23631220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023631220000" filename = "" Region: id = 2407 start_va = 0x23631230000 end_va = 0x23631230fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023631230000" filename = "" Region: id = 2408 start_va = 0x23631240000 end_va = 0x23631240fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023631240000" filename = "" Region: id = 2409 start_va = 0x23631250000 end_va = 0x23631250fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023631250000" filename = "" Region: id = 2410 start_va = 0x23631260000 end_va = 0x236312a8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 2411 start_va = 0x236312b0000 end_va = 0x236312b1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netprofmsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\netprofmsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netprofmsvc.dll.mui") Region: id = 2412 start_va = 0x236312c0000 end_va = 0x236312edfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000236312c0000" filename = "" Region: id = 2413 start_va = 0x236312f0000 end_va = 0x236312f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000236312f0000" filename = "" Region: id = 2414 start_va = 0x23631300000 end_va = 0x236313fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023631300000" filename = "" Region: id = 2415 start_va = 0x23631400000 end_va = 0x236314fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023631400000" filename = "" Region: id = 2416 start_va = 0x23631500000 end_va = 0x23631511fff monitored = 0 entry_point = 0x23631527630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2417 start_va = 0x23631520000 end_va = 0x23631526fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023631520000" filename = "" Region: id = 2418 start_va = 0x23631560000 end_va = 0x23631564fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 2419 start_va = 0x23631600000 end_va = 0x236316fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023631600000" filename = "" Region: id = 2420 start_va = 0x23631700000 end_va = 0x23631887fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023631700000" filename = "" Region: id = 2421 start_va = 0x23631890000 end_va = 0x23631a10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023631890000" filename = "" Region: id = 2422 start_va = 0x23631a20000 end_va = 0x23631afffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2423 start_va = 0x23631bd0000 end_va = 0x23631bd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023631bd0000" filename = "" Region: id = 2424 start_va = 0x23631c00000 end_va = 0x23631cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023631c00000" filename = "" Region: id = 2425 start_va = 0x23631d00000 end_va = 0x23632cfffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 2426 start_va = 0x23632d00000 end_va = 0x23633036fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2427 start_va = 0x23633900000 end_va = 0x236339fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023633900000" filename = "" Region: id = 2428 start_va = 0x23633a00000 end_va = 0x236341fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-s-1-5-21-1560258661-3990802383-1811730007-1000.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1560258661-3990802383-1811730007-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1560258661-3990802383-1811730007-1000.dat") Region: id = 2429 start_va = 0x23634200000 end_va = 0x236342fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023634200000" filename = "" Region: id = 2430 start_va = 0x23634400000 end_va = 0x236344fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023634400000" filename = "" Region: id = 2431 start_va = 0x7df5ff380000 end_va = 0x7ff5ff37ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff380000" filename = "" Region: id = 2432 start_va = 0x7ff65ac20000 end_va = 0x7ff65ad1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65ac20000" filename = "" Region: id = 2433 start_va = 0x7ff65ad20000 end_va = 0x7ff65ad42fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff65ad20000" filename = "" Region: id = 2434 start_va = 0x7ff65b180000 end_va = 0x7ff65b18cfff monitored = 0 entry_point = 0x7ff65b183980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2435 start_va = 0x7fffdb3b0000 end_va = 0x7fffdb3c1fff monitored = 0 entry_point = 0x7fffdb3b1a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 2436 start_va = 0x7fffdc3e0000 end_va = 0x7fffdc3f7fff monitored = 0 entry_point = 0x7fffdc3e4a20 region_type = mapped_file name = "perftrack.dll" filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll") Region: id = 2437 start_va = 0x7fffdee00000 end_va = 0x7fffdee1cfff monitored = 0 entry_point = 0x7fffdee06190 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 2438 start_va = 0x7fffe4c70000 end_va = 0x7fffe4c8dfff monitored = 0 entry_point = 0x7fffe4c71690 region_type = mapped_file name = "bluetoothapis.dll" filename = "\\Windows\\System32\\BluetoothApis.dll" (normalized: "c:\\windows\\system32\\bluetoothapis.dll") Region: id = 2439 start_va = 0x7fffe4c90000 end_va = 0x7fffe4ca8fff monitored = 0 entry_point = 0x7fffe4c92180 region_type = mapped_file name = "bthradiomedia.dll" filename = "\\Windows\\System32\\BthRadioMedia.dll" (normalized: "c:\\windows\\system32\\bthradiomedia.dll") Region: id = 2440 start_va = 0x7fffe4f40000 end_va = 0x7fffe4f53fff monitored = 0 entry_point = 0x7fffe4f41a50 region_type = mapped_file name = "wlanradiomanager.dll" filename = "\\Windows\\System32\\WlanRadioManager.dll" (normalized: "c:\\windows\\system32\\wlanradiomanager.dll") Region: id = 2441 start_va = 0x7fffe5010000 end_va = 0x7fffe5019fff monitored = 0 entry_point = 0x7fffe50114c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2442 start_va = 0x7fffe5280000 end_va = 0x7fffe528dfff monitored = 0 entry_point = 0x7fffe5281460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2443 start_va = 0x7fffe52d0000 end_va = 0x7fffe535afff monitored = 0 entry_point = 0x7fffe52ed2a0 region_type = mapped_file name = "netprofmsvc.dll" filename = "\\Windows\\System32\\netprofmsvc.dll" (normalized: "c:\\windows\\system32\\netprofmsvc.dll") Region: id = 2444 start_va = 0x7fffe5bb0000 end_va = 0x7fffe5bc9fff monitored = 0 entry_point = 0x7fffe5bb2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2445 start_va = 0x7fffe5bd0000 end_va = 0x7fffe5be5fff monitored = 0 entry_point = 0x7fffe5bd19f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2446 start_va = 0x7fffe5d70000 end_va = 0x7fffe5da7fff monitored = 0 entry_point = 0x7fffe5d88cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2447 start_va = 0x7fffe6390000 end_va = 0x7fffe639afff monitored = 0 entry_point = 0x7fffe6391d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2448 start_va = 0x7fffe69a0000 end_va = 0x7fffe69c8fff monitored = 0 entry_point = 0x7fffe69b24d0 region_type = mapped_file name = "fontprovider.dll" filename = "\\Windows\\System32\\FontProvider.dll" (normalized: "c:\\windows\\system32\\fontprovider.dll") Region: id = 2449 start_va = 0x7fffe69d0000 end_va = 0x7fffe6b71fff monitored = 0 entry_point = 0x7fffe6a1c2d0 region_type = mapped_file name = "fntcache.dll" filename = "\\Windows\\System32\\FntCache.dll" (normalized: "c:\\windows\\system32\\fntcache.dll") Region: id = 2450 start_va = 0x7fffe6ea0000 end_va = 0x7fffe6fd5fff monitored = 0 entry_point = 0x7fffe6ecf350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 2451 start_va = 0x7fffe88a0000 end_va = 0x7fffe8919fff monitored = 0 entry_point = 0x7fffe88c7630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2452 start_va = 0x7fffe89f0000 end_va = 0x7fffe89fcfff monitored = 0 entry_point = 0x7fffe89f2650 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 2453 start_va = 0x7fffe91c0000 end_va = 0x7fffe91d7fff monitored = 0 entry_point = 0x7fffe91c5910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2454 start_va = 0x7fffe92f0000 end_va = 0x7fffe92fbfff monitored = 0 entry_point = 0x7fffe92f14d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 2455 start_va = 0x7fffe9320000 end_va = 0x7fffe93e7fff monitored = 0 entry_point = 0x7fffe93613f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2456 start_va = 0x7fffe93f0000 end_va = 0x7fffe9450fff monitored = 0 entry_point = 0x7fffe93f4b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 2457 start_va = 0x7fffe9ea0000 end_va = 0x7fffe9ee9fff monitored = 0 entry_point = 0x7fffe9eaac30 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 2458 start_va = 0x7fffe9ef0000 end_va = 0x7fffe9f22fff monitored = 0 entry_point = 0x7fffe9efd5a0 region_type = mapped_file name = "biwinrt.dll" filename = "\\Windows\\System32\\biwinrt.dll" (normalized: "c:\\windows\\system32\\biwinrt.dll") Region: id = 2459 start_va = 0x7fffe9f30000 end_va = 0x7fffe9fc1fff monitored = 0 entry_point = 0x7fffe9f7a780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 2460 start_va = 0x7fffe9fd0000 end_va = 0x7fffea048fff monitored = 0 entry_point = 0x7fffe9fe7800 region_type = mapped_file name = "geolocation.dll" filename = "\\Windows\\System32\\Geolocation.dll" (normalized: "c:\\windows\\system32\\geolocation.dll") Region: id = 2461 start_va = 0x7fffea070000 end_va = 0x7fffea0a5fff monitored = 0 entry_point = 0x7fffea080070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2462 start_va = 0x7fffeb7e0000 end_va = 0x7fffeb806fff monitored = 0 entry_point = 0x7fffeb7e7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2463 start_va = 0x7fffeb830000 end_va = 0x7fffeb8d9fff monitored = 0 entry_point = 0x7fffeb857910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2464 start_va = 0x7fffeb8e0000 end_va = 0x7fffeb9dffff monitored = 0 entry_point = 0x7fffeb920f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 2465 start_va = 0x7fffebdc0000 end_va = 0x7fffebde3fff monitored = 0 entry_point = 0x7fffebdc3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2466 start_va = 0x7fffebf60000 end_va = 0x7fffec053fff monitored = 0 entry_point = 0x7fffebf6a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 2467 start_va = 0x7fffec520000 end_va = 0x7fffec53efff monitored = 0 entry_point = 0x7fffec525d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2468 start_va = 0x7fffec690000 end_va = 0x7fffec6ebfff monitored = 0 entry_point = 0x7fffec6a6f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2469 start_va = 0x7fffec860000 end_va = 0x7fffec86afff monitored = 0 entry_point = 0x7fffec8619a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2470 start_va = 0x7fffecc50000 end_va = 0x7fffecc78fff monitored = 0 entry_point = 0x7fffecc64530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2471 start_va = 0x7fffecc80000 end_va = 0x7fffecd18fff monitored = 0 entry_point = 0x7fffeccaf4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 2472 start_va = 0x7fffecdc0000 end_va = 0x7fffecdd3fff monitored = 0 entry_point = 0x7fffecdc52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2473 start_va = 0x7fffecde0000 end_va = 0x7fffece2afff monitored = 0 entry_point = 0x7fffecde35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2474 start_va = 0x7fffece40000 end_va = 0x7fffece4efff monitored = 0 entry_point = 0x7fffece43210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2475 start_va = 0x7fffece50000 end_va = 0x7fffed037fff monitored = 0 entry_point = 0x7fffece7ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2476 start_va = 0x7fffed740000 end_va = 0x7fffed7a9fff monitored = 0 entry_point = 0x7fffed776d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2477 start_va = 0x7fffed8f0000 end_va = 0x7fffed932fff monitored = 0 entry_point = 0x7fffed904b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2478 start_va = 0x7fffedba0000 end_va = 0x7fffedbfafff monitored = 0 entry_point = 0x7fffedbb38b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2479 start_va = 0x7fffedd80000 end_va = 0x7fffede26fff monitored = 0 entry_point = 0x7fffedd958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2480 start_va = 0x7fffede30000 end_va = 0x7fffeded6fff monitored = 0 entry_point = 0x7fffede3b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2481 start_va = 0x7fffef9f0000 end_va = 0x7fffefc6cfff monitored = 0 entry_point = 0x7fffefac4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2482 start_va = 0x7fffefd90000 end_va = 0x7fffefeabfff monitored = 0 entry_point = 0x7fffefdd02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2483 start_va = 0x7fffefeb0000 end_va = 0x7fffeff5cfff monitored = 0 entry_point = 0x7fffefec81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2484 start_va = 0x7fffeff60000 end_va = 0x7ffff00b5fff monitored = 0 entry_point = 0x7fffeff6a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2485 start_va = 0x7ffff00c0000 end_va = 0x7ffff0180fff monitored = 0 entry_point = 0x7ffff00e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2486 start_va = 0x7ffff0340000 end_va = 0x7ffff04c5fff monitored = 0 entry_point = 0x7ffff038ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2487 start_va = 0x7ffff0530000 end_va = 0x7ffff0537fff monitored = 0 entry_point = 0x7ffff0531ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2488 start_va = 0x7ffff0540000 end_va = 0x7ffff05aafff monitored = 0 entry_point = 0x7ffff05590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2489 start_va = 0x7ffff05b0000 end_va = 0x7ffff06f2fff monitored = 0 entry_point = 0x7ffff05d8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2490 start_va = 0x7ffff0700000 end_va = 0x7ffff079cfff monitored = 0 entry_point = 0x7ffff07078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2491 start_va = 0x7ffff07a0000 end_va = 0x7ffff0960fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2535 start_va = 0x86e6f00000 end_va = 0x86e6ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e6f00000" filename = "" Region: id = 2547 start_va = 0x86e7000000 end_va = 0x86e70fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e7000000" filename = "" Region: id = 2551 start_va = 0x86e7100000 end_va = 0x86e71fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e7100000" filename = "" Region: id = 2559 start_va = 0x86e7200000 end_va = 0x86e72fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000086e7200000" filename = "" Thread: id = 175 os_tid = 0xe18 Thread: id = 176 os_tid = 0x884 Thread: id = 177 os_tid = 0x9ac Thread: id = 178 os_tid = 0x630 Thread: id = 179 os_tid = 0xb3c Thread: id = 180 os_tid = 0x2c8 Thread: id = 181 os_tid = 0x3a4 Thread: id = 182 os_tid = 0x380 Thread: id = 183 os_tid = 0x924 Thread: id = 184 os_tid = 0x90c Thread: id = 185 os_tid = 0x890 Thread: id = 186 os_tid = 0x818 Thread: id = 187 os_tid = 0x574 Thread: id = 188 os_tid = 0x570 Thread: id = 189 os_tid = 0x56c Thread: id = 190 os_tid = 0x568 Thread: id = 191 os_tid = 0x540 Thread: id = 192 os_tid = 0x260 Thread: id = 193 os_tid = 0x14c Thread: id = 194 os_tid = 0x2e8 Thread: id = 195 os_tid = 0x284 Thread: id = 196 os_tid = 0x3c8 Thread: id = 197 os_tid = 0x3c4 Thread: id = 198 os_tid = 0x3b4 Thread: id = 199 os_tid = 0x368 Thread: id = 202 os_tid = 0x10a8 Thread: id = 210 os_tid = 0xfec Thread: id = 214 os_tid = 0xc8c Thread: id = 222 os_tid = 0x130c